1. Introduction
This Privacy Policy provides information about how Kladero GmbH i.G. (hereinafter referred to as “Kladero” or “we” or “us”) processes personal data. In particular, we process personal data relating to the following categories of individuals:
- Individuals who represent or work for our Customers (where “Customer” means any natural or legal person that enters into an agreement with Kladero, either as “Kladero Product Customer” if the agreement concerns access to a Kladero product, or as “Kladero Service Customer” if the agreement concerns the provision of services by Kladero), including contact persons, authorized representatives, account administrators, billing contacts, and authorized users of Kladero products or services (hereinafter collectively referred to as “Customer Personnel and Users”);
- Customers who are natural persons;
- Individuals who visit our websites, contact us, attend our events, interact with our communications or social media channels, or otherwise express an interest in Kladero or its products or services (hereinafter collectively referred to as “Prospects”);
- Individuals who create an account for, access, or otherwise use the Kladero Platform, whether on their own behalf or on behalf of another person or organization (hereinafter collectively referred to as “Kladero Platform Users”);
- Individuals who represent or work for our suppliers, service providers, professional advisers, cooperation partners, or other business partners (hereinafter collectively referred to as “Supplier and Business Partner Personnel”);
- Individuals who apply for employment or otherwise participate in a recruitment process with Kladero (hereinafter collectively referred to as “Job Applicants”); and
- Other individuals who communicate or otherwise interact with Kladero in a professional or business context (hereinafter collectively referred to as “Other Business Contacts”).
This Privacy Policy applies to Prospects and Other Business Contacts, including in the situations described below and in any other circumstances covered by this Privacy Policy:
- visit www.kladero.com (hereinafter referred to as “this website” or “our website”) or any other website operated by Kladero that links to this Privacy Policy (together with this website, hereinafter referred to as “our websites”);
- use or interact with our social media channels:
- attend or otherwise interact with us at events;
- contact us or otherwise express an interest in Kladero or its products or services; or
- have your personal data provided to us by a third party in connection with any of the activities described above.
This Privacy Policy may also apply where you are Customer, Customer Personnel and Users, Supplier and Business Partner Personnel, or a Job Applicant, including in the situations described above and in any other relevant circumstances covered by this Privacy Policy. For processing relating specifically to these categories, this Privacy Policy is supplemented by other privacy policies listed under the “Privacy” section of our Legal Center page.
Where a supplemental privacy policy contains more specific provisions concerning particular processing activities, those provisions shall prevail with respect to those processing activities.
2. Controller responsible for processing
For the processing activities covered by this Privacy Policy, Kladero acts as the controller and determines the purposes and means of the processing. The contact details of Kladero are as follows:
- Company: Kladero GmbH i.G.
- Address: Rüttenscheider Straße 120, 45131 Essen, Germany
- Managing directors: Paul-Andrei Dragan, Sven Michael Smolka
- Telephone: +49 231 13751426
- Privacy contact email: contact@kladero.com
3. Definitions
For the purposes of this Privacy Policy, “personal data” means any information relating to an identified or identifiable natural person. An identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to that person. Personal data does not include information that has been rendered anonymous in such a manner that the individual is no longer identifiable.
A “data subject” is the identified or identifiable natural person to whom personal data relates.
“Processing” means any operation performed on personal data, whether or not by automated means, including collecting, recording, organizing, structuring, storing, adapting, retrieving, consulting, using, disclosing, restricting, erasing, or destroying personal data.
4. Legal bases for processing
We process personal data in accordance with the General Data Protection Regulation (“GDPR”) and other applicable data protection laws. We process personal data only where an applicable legal basis permits the processing. The legal basis applicable to each processing activity is identified in the relevant section of this Privacy Policy.
4.1 Performance of a contract
We process personal data where the following is necessary:
- to take steps at your request before entering into a contract; or
- to perform a contract to which you are a party.
The legal basis is Article 6(1)(b) GDPR (“Performance of Contract”). This legal basis may apply, for example, where you contact us concerning a potential contract or request an appointment in connection with Kladero's products or services.
Where you act on behalf of an organization, we generally process your personal data on the basis of our Legitimate Interests under Article 6(1)(f) GDPR in managing the relevant business relationship and communicating with the organization you represent.
4.2 Consent
We process personal data for specific purposes where you have given your consent.
The legal basis is Article 6(1)(a) GDPR (“Consent”). This legal basis may apply, for example, when you subscribe to our newsletter, consent to receive direct marketing communications, or consent to a recording or another optional processing activity.
You may withdraw your consent at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
4.3 Legal obligations
We process personal data where this is necessary to comply with a legal obligation to which Kladero is subject.
The legal basis is Article 6(1)(c) GDPR (“Legal Obligations”). This legal basis may apply, for example, where we are required to retain records, respond to a competent public authority, comply with tax or commercial law, or fulfill obligations under data protection law.
4.4 Legitimate interests
We process personal data where this is necessary for our Legitimate Interests or those of a third party, provided that those interests are not overridden by your interests, fundamental rights, or freedoms.
The legal basis is Article 6(1)(f) GDPR (“Legitimate Interests”). Depending on the processing activity, the interests pursued include:
- responding to and managing inquiries, communications, and professional interactions;
- developing and managing prospective business relationships;
- operating, maintaining, and improving our websites, communications, and social media profiles;
- administering communications, subscriptions, preferences, appointments, and events;
- ensuring the delivery, accuracy, and reliability of our communications;
- protecting our websites, systems, communications, and users against misuse, fraud, unauthorized access, attacks, and other security threats;
- understanding the general use and performance of our websites and social media profiles;
- documenting consent, withdrawals, objections, communications, and other relevant activities;
- complying with accountability and evidentiary requirements; and
- establishing, exercising, or defending legal claims.
Before relying on Legitimate Interests, we assess the relevant interests and consider the potential impact of the processing on the individuals concerned.
Where we process personal data on the basis of Legitimate Interests, you may object to the processing on grounds relating to your particular situation, as described in Section 5.
5. Your rights
Subject to the conditions and limitations set out in applicable data protection law, you have the following rights regarding the processing of your personal data:
5.1 Right of access
In accordance with Article 15 GDPR, you have the right to obtain confirmation as to whether we process personal data concerning you and, where this is the case, to obtain access to that personal data and the information specified in Article 15 GDPR.
5.2 Right to rectification
In accordance with Article 16 GDPR, you have the right to request the correction of inaccurate personal data concerning you and the completion of incomplete personal data.
5.3 Right to erasure
In accordance with Article 17 GDPR, you have the right to request the erasure of personal data concerning you where the applicable legal requirements are met.
5.4 Right to restriction of processing
In accordance with Article 18 GDPR, you have the right to request the restriction of the processing of your personal data where the applicable legal requirements are met.
5.5 Right to data portability
In accordance with Article 20 GDPR, where processing is based on consent or a contract and is carried out by automated means, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format and, where technically feasible, to have that data transmitted directly to another controller.
5.6 Right to object
In accordance with Article 21 GDPR, where we process your personal data on the basis of legitimate interests, you have the right to object to the processing on grounds relating to your particular situation. Where personal data is processed for direct marketing purposes, you have the right to object at any time to such processing, including related profiling.
5.7 Right to withdraw consent
In accordance with Article 7(3) GDPR, where processing is based on your consent, you may withdraw that consent at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
5.8 Rights relating to automated decision-making
In accordance with Article 22 GDPR, where applicable, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, subject to the applicable legal exceptions and safeguards.
5.9 Right to lodge a complaint
In accordance with Article 77 GDPR, you have the right to lodge a complaint with a competent data protection supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement.
The supervisory authority responsible for Kladero is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), whose contact details are available at https://www.ldi.nrw.de.
6. Processed personal data
Depending on how you interact with us, we may process the following categories of personal data.
6.1 Personal data collected directly from you
We may collect the following categories of personal data directly from you when you communicate or otherwise interact with Kladero:
| Category of personal data | Description and examples | When we collect it |
|---|---|---|
| Identity data | Information used to identify or distinguish you, such as your first name, last name, salutation, title, and, where relevant, username or another personal identifier. | When you contact us, register for or attend an event, schedule an appointment, subscribe to communications, or otherwise interact with Kladero. |
| Contact data | Information used to communicate with you, such as your email address, telephone number, postal address, country, and social media contact details. | When you provide your contact details through a form, by email, by telephone, through social media, at an event, or through another communication channel. |
| Professional and organizational data | Information concerning your professional role or organizational affiliation, such as your employer or organization, business unit, job title, professional responsibilities, company size, team type, and team size. | When you contact us in a professional capacity, express an interest in our products or services, register for an event, or otherwise engage with Kladero on behalf of an organization. |
| Inquiry and correspondence data | The content and context of communications exchanged with Kladero, such as messages, emails, inquiries, questions, correspondence history, the subject of your request, products or services of interest, and documents or other information included in your communication. | When you contact us through our website, by email, through social media, by telephone, or through another communication channel. |
| Appointment and scheduling data | Information required to arrange or manage meetings, such as your availability, preferred date and time, time zone, meeting format, scheduling selections, and cancellation or rescheduling information. | When you request, book, change, or cancel an appointment or meeting with Kladero. |
| Communication preference data | Information concerning how you prefer us to communicate with you, such as your preferred language, communication channel, communication frequency, and accessibility-related communication preferences. | When you state or update your communication preferences or select options made available through our forms or communications. |
| Marketing and subscription data | Information concerning your receipt of marketing communications, such as newsletter subscription status, topics of interest, marketing selections, opt-in status, opt-out status, and suppression-list status. | When you subscribe to communications, request information about Kladero, provide or withdraw marketing consent, object to direct marketing, or update your preferences. |
| Consent records | Records demonstrating the giving, confirmation, withdrawal, or refusal of consent and the management of your preferences, including the relevant wording and privacy information presented to you, the method of collection, timestamps, confirmation status, and associated technical records. | When you provide, confirm, refuse, or withdraw consent, or when you set or update a privacy or communication preference. |
| Email confirmation data | Records relating to the confirmation of an email address, such as confirmation status, confirmation timestamps, and the confirmation method used. | When we ask you to confirm an email address, including in connection with contact requests, newsletter subscriptions, or other communications. |
| Data-subject request and compliance data | Information relating to requests made under data protection law, such as the type and content of the request, correspondence concerning the request, identity-verification information, records of our assessment and response, and any restriction, objection, or suppression instruction resulting from the request. | When you exercise or seek to exercise a right relating to your personal data, submit a privacy complaint, or otherwise communicate with us about data protection. |
| Event participation data | Information concerning your registration for and participation in an event, such as the event registered for, registration status, attendance status, dietary or accessibility requirements, questions submitted, session selections, and feedback provided. | When you register for, attend, speak at, or otherwise participate in an online or in-person event organized by or involving Kladero. |
| Audio, image, and audiovisual data | Photographs, images, audio recordings, video recordings, voice data, and recorded statements in which you may be identifiable. | When you participate in a recorded call, meeting, interview, presentation, webinar, or event, subject to any notice or consent required by applicable law. |
| Terms, notice, and acknowledgment data | Records concerning terms, privacy information, notices, policies, declarations, or other legal information presented to you, and any acceptance or acknowledgment by you, including the relevant version, date, time, method, and associated technical records | When we provide legal information or ask you to accept or acknowledge applicable terms, notices, policies, or declarations |
| Other data provided by you | Any other personal data that you voluntarily provide and that is not covered by one of the categories above. This may include personal data contained in free-text fields, attachments, or other materials submitted to Kladero. | When you voluntarily provide such information in the course of communicating or otherwise interacting with Kladero. |
6.2 Personal data generated through our communications and when you use our website
6.2.1 Personal data automatically generated through our communications
We may generate the following personal data when we send or otherwise manage communications:
| Category of personal data | Description and examples | When we generate it |
|---|---|---|
| Communication delivery and status data | Technical and status information concerning communications, such as email delivery status, bounce information, failed delivery attempts, unsuccessful contact attempts, and whether a telephone call was answered. | When we send or attempt to send emails or other electronic communications, or make or attempt to make telephone calls. |
6.2.2 Personal data automatically generated when you use our website
We may generate or automatically collect the following personal data when you use our websites:
| Category of personal data | Description and examples | When we collect or generate it |
|---|---|---|
| Network and connection data | Information concerning the connection between your device and our websites, such as your IP address, date and time of access, referring URL, destination URL, requested domain, network protocol, response status, and amount of data transferred. | When your device establishes a connection with, requests a resource from, or otherwise communicates with our websites or related infrastructure. |
| Device and browser data | Technical information concerning the device, software, and configuration used to access our websites, such as device type, operating system, browser type and version, language settings, screen or viewport characteristics, and supported technical capabilities. | When your browser or device transmits this information as part of a website request or when it is required to display or operate a website function. |
| Request and server-log data | Records generated in connection with website requests, such as the requested resource, request method, timestamp, response code, server or application events, request identifiers, and error records. | When our servers, applications, or infrastructure receive and process requests relating to our websites. |
| Session and security identifier data | Temporary or persistent technical identifiers used to maintain website functions or protect communications, such as session identifiers, CSRF tokens, request identifiers, security tokens, and similar authentication or integrity-protection values. | When such identifiers are created, transmitted, or verified to establish or maintain a session, protect a form, or secure a website function. |
| Security event and misuse-prevention data | Information relating to actual or suspected security events or misuse, such as failed or unusual requests, rate-limit events, blocked requests, indicators of automated activity, suspected attack patterns, fraud indicators, and records of security investigations or remedial measures. | When our systems detect, assess, prevent, investigate, or respond to suspected misuse, fraud, unauthorized access, attacks, or other security threats. |
| Website interaction and functional usage data | Information concerning how website functions are used, such as pages or functions accessed, navigation paths, interactions with forms or interface elements, application events, and the sequence or duration of interactions. | When you navigate through or interact with our websites, to the extent such information is collected through the website functionality described in this Privacy Policy. |
| Diagnostic and performance data | Information used to assess the technical operation of our websites, such as loading times, latency, application failures, browser errors, crash information, availability measurements, and other diagnostic events. | When a technical event, failure, performance measurement, or diagnostic process occurs in connection with our websites. |
| Referral and campaign attribution data | Information describing how you reached our websites, such as the referring website, campaign identifier, source, medium, content identifier, and UTM or comparable parameters included in the URL. | When you access our websites through a link or URL containing referral, campaign, or attribution information. |
| Cookie and similar-technology data | Information stored or accessed through cookies or comparable technologies, including the identifier, purpose, provider, validity period, and associated preference or session information. | When a cookie or comparable technology is used, as described in our cookie information or consent interface. |
6.3 Personal data obtained from third parties
In limited circumstances, we may obtain personal data concerning you from third parties or publicly accessible sources.
Where we obtain personal data from a third party and have not already provided you with the relevant privacy information, we provide that information within the period required by Article 14 GDPR, unless an applicable exception permits us not to do so.
6.3.1 Your employer, organization, or professional contacts
When your employer, organization, or professional contacts introduce you to us, include you in business communication, identify you as a relevant contact person, or authorize you to act on behalf of an organization, we may be provided with your: identity data; contact data; professional and organizational data; and inquiry and correspondence data.
6.3.3 Event organizers and cooperation partners
When you register for or attend an event organized jointly with, or on behalf of Kladero, we may be provided by the event organizers, hosts, and cooperation partners with your identity data, contact data, professional and organizational data, and event participation data.
7. Processing activities
The following sections describe how we process personal data in connection with specific activities.
For each activity, we provide information about the scope of the processing, the categories of personal data processed, the purposes of the processing, and the applicable legal basis. Where relevant, we also explain activity-specific choices available to you.
7.2 Personalized and direct marketing based on your request
7.2.1 Scope
This section applies where you consent to receive personalized or direct marketing communications from Kladero, including through the “Contact us” form on our website, another online form, an event or registration form, email correspondence, or another consent mechanism made available by Kladero.
We may contact you through the communication channels covered by your consent and personalize those communications using information you have provided, your expressed interests, and your previous interactions with Kladero.
Where you provide consent through the “Contact us” form on our website, we use a double opt-in process. We send a confirmation message to the email address you provided, and your consent becomes effective when you confirm it through the link in that message.
In other contexts, including forms provided in connection with an event, we may use a single opt-in process. In that case, your consent becomes effective when you submit the relevant form or otherwise provide the requested consent.
7.2.2 Processed personal data, purposes, and legal basis
| Personal data processed | Purpose of processing | Legal basis |
|---|---|---|
| Contact data | To send or otherwise provide direct marketing communications | Consent |
| Professional and organizational data | To tailor marketing communications to your organization, professional role, or potential business needs | Consent |
| Communication preference data | To provide marketing communications in your preferred language and through your preferred communication channel | Consent |
| Inquiry and correspondence data | To personalize subsequent marketing communications based on your previous communications and interactions with Kladero | Consent |
| Marketing and subscription data | To manage your marketing preferences and to ensure that unsubscribe and objection requests are applied | Legitimate Interests |
| Communication delivery and status data | To administer marketing communications and maintain accurate contact and delivery records | Legitimate Interests |
| Email confirmation data | To verify your email address and complete the double opt-in process | Legitimate Interests |
Where processing is based on Consent, the processing is carried out to provide and personalize the marketing communications that you requested through the communication channels covered by your consent.
Our Legitimate Interests are to administer the technical delivery of marketing communications, maintain accurate contact and delivery records, manage marketing preferences and suppression records, and verify email addresses through the double opt-in process.
7.2.3 Your choices
You may withdraw your consent at any time by using the unsubscribe or withdrawal mechanism included in the relevant communication or by contacting us using the privacy contact details provided in this Privacy Policy.
7.3 Direct marketing to B2B prospects
7.3.1 Scope
This section applies where we contact you in your professional capacity for direct marketing purposes without relying on your consent and where the communication is permitted by applicable law.
This may include postal marketing, telephone communications to business contacts where there is sufficient reason to presume an interest in the specific communication, and email marketing to existing customers concerning similar products or services where the applicable statutory requirements are met.
7.3.2 Processed personal data, purposes, and legal basis
| Personal data processed | Purpose of processing | Legal basis |
|---|---|---|
| Contact data | To contact you in your professional capacity through a communication channel permitted by applicable law | Legitimate Interests |
| Professional and organizational data | To determine whether the communication is relevant to your professional role, organization, or potential business needs | Legitimate Interests |
| Inquiry and correspondence data | To take account of your previous business communications and interactions with Kladero | Legitimate Interests |
| Marketing and subscription data | To apply your marketing preferences and ensure that objections to direct marketing are respected | Legitimate Interests |
| Communication delivery and status data | To administer marketing communications and maintain accurate contact and delivery records | Legitimate Interests |
Our Legitimate Interests are to promote Kladero and its products or services to relevant business contacts and to develop potential and existing business relationships, provided that the communication is permitted by applicable law and your interests, rights, and freedoms do not override those interests.
7.3.3 Your choices
You may object to the processing of your personal data for direct marketing at any time. Following your objection, we will no longer process your personal data for that purpose.
You may object by using the objection or unsubscribe mechanism included in the relevant communication or by contacting us using the privacy contact details provided in this Privacy Policy.
7.5 Security and prevention of misuse
7.5.1 Scope
This section applies when we process personal data to protect our websites, systems, and communications against unauthorized access, misuse, fraud, attacks, technical failures, and other security threats.
7.5.2 Processed personal data, purposes, and legal basis
| Personal data processed | Purpose of processing | Legal basis |
|---|---|---|
| Network and connection data | To monitor the security and operation of our websites, detect technical errors, and investigate security incidents | Legitimate Interests |
| Session and security identifier data | To protect sessions, prevent abusive or unauthorized requests, enforce rate limits, and secure website functions | Legitimate Interests |
| Security event and misuse-prevention data | To detect, prevent, investigate, and respond to misuse, fraud, attacks, and other security threats | Legitimate Interests |
| Request and server-log data | To operate and monitor our websites, diagnose failed or unusual requests, and investigate technical or security incidents | Legitimate Interests |
| Diagnostic and performance data | To identify technical failures, assess website performance, and maintain the availability and reliability of our websites | Legitimate Interests |
Our Legitimate Interests are to protect the confidentiality, integrity, availability, and reliability of our websites, systems, and communications; prevent unauthorized access and misuse; detect and investigate technical or security incidents; and maintain the secure and stable operation of our infrastructure.
7.5.3 Your choices
The security measures described above are necessary to protect our websites, systems, communications, and users. They cannot generally be disabled for individual visitors or users.
Where this processing is based on Legitimate Interests, you retain the right to object on grounds relating to your particular situation, as described in the section “Your rights.” We may continue the processing where we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where the processing is necessary for the establishment, exercise, or defense of legal claims.
7.6 Contact requests
7.6.1 Scope
This section applies when you contact us through the “Contact us” form on our website, by email, through messages sent to our social media profiles, by telephone, or through another communication channel made available by Kladero.
7.6.2 Processed personal data, purposes, and legal basis
| Personal data processed | Purpose of processing | Legal basis |
|---|---|---|
| Contact data | To receive, review, and respond to your request | Legitimate Interests or, where your request concerns a potential contract, Performance of Contract |
| Professional and organizational data | To understand the context of your request and provide an appropriate response | Legitimate Interests or, where your request concerns a potential contract, Performance of Contract |
| Communication preference data | To communicate with you in your preferred language and through your preferred communication channel | Legitimate Interests or, where your request concerns a potential contract, Performance of Contract |
| Email confirmation data | To verify the email address provided with your request and prevent misuse when you use our “Contact us” form | Legitimate Interests |
| Inquiry and correspondence data | To process your request, communicate with you, and document the interaction | Legitimate Interests or, where your request concerns a potential contract, Performance of Contract |
| Appointment and scheduling data | To arrange and conduct an appointment requested by you | Legitimate Interests or, where the appointment is requested by you in connection with a potential contract, Performance of Contract |
| Other data provided by you | To process your request in accordance with its content | Legitimate Interests or, where applicable, Performance of Contract |
Where processing is based on Performance of Contract, the processing is necessary to take steps at your request before entering into a contract, including understanding your requirements, responding to questions concerning our products or services, and arranging related appointments or discussions.
Our Legitimate Interests are to receive and respond to communications, understand the context of requests, communicate effectively with business contacts, organize requested appointments, maintain appropriate records of correspondence, and protect our contact channels against misuse.
7.6.3 Your choices
You may choose which information to provide when contacting us. However, we may be unable to respond to your request or arrange an appointment if you do not provide the information necessary for that purpose.
You may also update your communication preferences or request the cancellation of your appointment by contacting us through the relevant communication channel.
7.7 RSS and Atom feeds
7.7.1 Scope
This section applies when you access or subscribe to an RSS or Atom feed provided through our websites. We process personal data to deliver the feeds, maintain their technical operation, protect them against misuse, and generate anonymous aggregated statistics concerning their use.
Network and connection data used to generate these statistics is processed temporarily. We retain only aggregated statistics that do not permit us to identify individual users.
7.7.2 Processed personal data, purposes, and legal basis
| Personal data processed | Purpose of processing | Legal basis |
|---|---|---|
| Network and connection data | To deliver the RSS and Atom feeds, monitor their technical operation, and detect errors | Legitimate Interests |
| Network and connection data | To generate anonymous aggregated statistics concerning the use of our RSS and Atom feeds; processed temporarily | Legitimate Interests |
| Security event and misuse-prevention data | To enforce rate limits and prevent automated misuse, attacks, or excessive requests | Legitimate Interests |
Our Legitimate Interests are to provide reliable RSS and Atom feeds, understand their general use, maintain their technical operation, and protect them and our related infrastructure against misuse and security threats.
The resulting aggregated statistics do not permit us to identify individual users.
7.7.3 Your choices
You may stop accessing or unsubscribe from the RSS and Atom feeds at any time through your RSS and/or Atom reader or readers.
7.8 Website analytics
7.8.1 Scope
We use self-hosted analytics to obtain aggregated statistics about the use of our websites. We do not use cookies or other persistent tracking technologies for analytics and do not create profiles of individual visitors.
Certain connection information is processed temporarily to distinguish repeated visits. This information is not retained in the analytics database. Only aggregated statistics are retained.
7.8.2 Processed personal data, purposes, and legal basis
| Personal data processed | Purpose of processing | Legal basis |
|---|---|---|
| Network and connection data processed | To distinguish visits and generate aggregated website statistics; processed temporarily. | Legitimate Interests |
| Referral and campaign attribution data | To generate aggregated statistics about how visitors reach our websites and the general performance of referral sources and campaigns | Legitimate Interests |
Our Legitimate Interest is to understand the general use and performance of our websites and to improve their content, structure, and technical operation.
The resulting aggregated statistics do not permit us to identify individual visitors.
7.9 Events
7.9.1 Scope
This section applies when you register for, attend, or otherwise participate in an online or in-person event organized by Kladero, including webinars, workshops, presentations, meetings, and similar events.
Where an event is organized jointly with another organization or through an external event platform, the relevant organization or platform may process personal data under its own responsibility. Please review the applicable privacy information provided by that organization or platform.
7.9.2 Processed personal data, purposes, and legal basis
| Personal data processed | Purpose of processing | Legal basis |
|---|---|---|
| Contact data | To process your registration, communicate with you about the event, and provide access to or information concerning the event | Performance of Contract |
| Professional and organizational data | To understand the professional context of your participation and organize the event appropriately | Legitimate Interests |
| Event participation information, in particular registration status and details | To organize and conduct the event and manage participation | Performance of Contract |
| Event participation information, in particular dietary or accessibility requirements | To make dietary, accessibility, or other requested accommodations for your participation in the event | Consent; where the information reveals special categories of personal data, explicit consent under Article 9(2)(a) GDPR |
| Event participation information, in particular, attendance information, questions, and feedback | To evaluate and improve our events | Legitimate Interests |
| Communication preferences, in particular your preferred language | To provide event-related communications in your preferred language | Performance of Contract |
| Image, audio, and audiovisual data showing the event, its speakers, or participants in a general event context | To document and report on the event, including through general event photographs or recordings | Legitimate Interests |
| Image, audio, and audiovisual data focused on you, such as portraits, interviews, testimonials, or identifiable recordings | To create and publish recordings or other promotional content featuring you | Consent |
Where processing is based on Performance of Contract, the processing is necessary to register you for, provide access to, and organize your participation in the event you requested.
Our Legitimate Interests are to organize events appropriately for their intended professional audience, evaluate and improve our events, and document and report on events through general photographs or recordings, provided that your interests, rights, and freedoms do not override those interests.
7.9.3 Your choices
You may choose not to provide information requested in connection with an event. However, if you do not provide information necessary to process your registration, communicate essential event details, or manage your participation, you may be unable to register for or attend the event.
Other information, such as dietary or accessibility requirements, is optional. If you do not provide it, we may be unable to make appropriate arrangements for you.
You may cancel your registration (subject to the event-specific terms and conditions) or update information relating to your participation by contacting us through the relevant registration or communication channel.
7.10 Data protection requests
7.10.1 Scope
This section applies when you contact Kladero to exercise your rights concerning your personal data or submit another data-protection-related request.
7.10.2 Processed personal data, purposes, and legal basis
| Personal data processed | Purpose of processing | Legal basis |
|---|---|---|
| Identity data | To identify you and verify your identity where necessary | Legal Obligations |
| Contact data | To communicate with you concerning the request | Legal Obligations |
| Data-subject request and compliance data | To assess, process, respond to, and document your request | Legal Obligations |
Where processing is based on Legal Obligations, the processing is necessary to receive, assess, and respond to requests made under applicable data protection law, verify the identity of the requesting person where necessary, and document the handling of the request.
7.10.3 Your choices
You must provide the information necessary for us to identify you, verify your identity where required, and understand the scope of your request. If you do not provide this information, we may be unable to process or respond to your request.
7.11 Disputes and legal claims
7.11.1 Scope
This section applies where a dispute arises between you and Kladero or where personal data is necessary to establish, exercise, or defend legal claims.
7.11.2 Processed personal data, purposes, and legal basis
| Personal data processed | Purpose of processing | Legal basis |
|---|---|---|
| Identity data | To identify the persons involved in the dispute or legal claim | Legitimate Interests |
| Contact data | To communicate with you and other relevant persons concerning the dispute or legal claim | Legitimate Interests |
| Network and connection data, request and server-log data, website interaction and functional usage data, and diagnostic and performance data, where relevant | To investigate the circumstances of the dispute and verify relevant events | Legitimate Interests |
| Session and security identifier data and security event and misuse-prevention data, where relevant | To investigate security-related circumstances and preserve relevant evidence | Legitimate Interests |
| Inquiry, correspondence, and communication data | To assess the positions of the persons involved, communicate concerning the dispute, and document its handling | Legitimate Interests |
| Terms, notice, and acknowledgment data | To determine which terms, notices, policies, or declarations were presented or accepted and preserve evidence relevant to the dispute or legal claim | Legitimate Interests |
Our Legitimate Interests are to investigate and resolve disputes, protect Kladero’s legal rights, preserve relevant evidence, and establish, exercise, or defend legal claims.
7.12 Data protection compliance and documentation
7.12.1 Scope
This section applies where we retain or otherwise process information to comply with, and demonstrate compliance with, applicable data protection law.
7.12.2 Processed personal data, purposes, and legal basis
| Personal data processed | Purpose of processing | Legal basis |
|---|---|---|
| Consent records | To demonstrate that appropriate consent was obtained and that any subsequent withdrawal was respected | Legal Obligations |
| Data-subject request and compliance data | To document the handling of data protection requests and demonstrate compliance with applicable requirements | Legal Obligations |
| Identity data | To document any verification undertaken in connection with a data protection request or any determination that the requesting person could not be identified | Legal Obligations |
| Assessment and decision records | To document decisions concerning requests considered manifestly unfounded or excessive, objections to processing, and other data protection assessments | Legal Obligations |
| Compliance records and related communications | To establish, exercise, or defend legal claims and respond to inquiries or proceedings involving supervisory authorities | Legitimate Interests |
Our Legitimate Interests are to establish, exercise, and defend legal claims and to demonstrate the lawfulness of our processing where this is not already required by a specific legal obligation.
8. Recipients of personal data
We disclose personal data only where necessary for the purposes described in this Privacy Policy. We do not sell or trade personal data.
Depending on the relevant processing activity, personal data may be disclosed to the following recipients:
- authorized employees and other personnel of Kladero who require access to the personal data to perform their duties;
- professional advisers, including lawyers, tax advisers, accountants, and auditors;
- public authorities, courts, and other public bodies where disclosure is required or permitted by applicable law; and
- other recipients where you have expressly authorized the disclosure or where disclosure is otherwise required or permitted by applicable law.
We also engage service providers that process personal data in connection with the operation of our websites and business communications. Our principal service providers are listed below:
| Category of service provider | Provider | Principal processing location |
|---|---|---|
| Website hosting and infrastructure | Hetzner Online GmbH | European Union |
| Transactional email delivery | Mindbaz SAS (Sweego) | European Union |
| Newsletter and marketing email delivery | Mindbaz SAS (Sweego) | European Union |
| Network services | Cloudflare, Inc. and its affiliates | European Union and other countries, including the United States |
| Business email and related business applications | Zoho group companies | European Union and, in limited circumstances, other countries |
9. Retention and erasure of personal data
We retain personal data only for as long as necessary for the purposes for which it was collected, unless continued retention is required or permitted by applicable law.
The applicable retention period depends on the nature of the personal data, the relevant processing purpose, and any applicable statutory retention or limitation periods.
9.1 Principal retention periods
The principal retention periods applicable to the processing activities described in this Privacy Policy are set out below:
| Retention period | Personal data and processing context |
|---|---|
| Until you withdraw your consent, unsubscribe, or object to direct marketing | Personal data processed for newsletters and direct marketing |
| Until you withdraw your objection or Kladero permanently ceases the relevant marketing activity | Limited suppression records retained to prevent further marketing communications following a withdrawal of consent, unsubscribe request, or objection |
| For a limited period after the confirmation request was sent, unless the subscription or consent is confirmed | Unconfirmed newsletter or marketing subscription requests and associated email confirmation data |
| Until the appointment or event has ended and any necessary organizational follow-up has been completed | Appointment, scheduling, and event participation data used solely to arrange or conduct the appointment or event |
| Generally for up to three years after the last substantive interaction | Contact requests, business correspondence, and social media communications |
| For the period communicated when the recording is made or, where processing is based on consent, until consent is withdrawn, subject to any permitted continued retention | Event photographs, audio recordings, audiovisual recordings, interviews, and testimonials |
| Generally for three years from the end of the calendar year in which the relevant activity ended, where necessary to document compliance or establish, exercise, or defend legal claims | Consent records, terms, notice, and acknowledgment data, data-subject request and compliance data, correspondence, dispute records, and other relevant evidentiary records |
| Generally for no more than 30 days after collection | Network and connection data, request and server-log data, and ordinary website, RSS, and Atom access records |
| Until the relevant security event has been investigated and resolved and, where necessary, for an additional period for compliance documentation or legal claims | Security event and misuse-prevention data |
9.2 Extended retention
We may retain personal data beyond the principal retention periods where this is required by applicable commercial, tax, accounting, or other statutory retention obligations, or where retention is necessary to establish, exercise, or defend legal claims.
Unless a different limitation period applies, records relevant to potential civil-law claims may generally be retained until the expiry of the regular statutory limitation period. Under German law, this period is generally three years and usually begins at the end of the calendar year in which the relevant claim arose and the party entitled to assert the claim became aware, or should have become aware, of the relevant circumstances.
Longer periods may apply where proceedings are pending, a limitation period has been suspended or restarted, a claim has been legally established, or a special statutory retention or limitation period applies.
Where personal data is retained solely for a statutory retention obligation or for legal claims, we restrict its processing to those purposes. It will not be used for marketing, analytics, or other ordinary operational purposes during the extended retention period.
9.3 Erasure and anonymization
After the applicable retention period has expired, we erase or irreversibly anonymize the personal data unless continued retention is required or permitted by applicable law.
Erasure may take place through a scheduled deletion process rather than immediately upon expiry of the relevant retention period.
Personal data contained in backup systems may remain for a limited period until the relevant backup is overwritten or deleted in accordance with our backup procedures. During that period, the data is not used for ordinary operational purposes and is restored only where necessary for business continuity, security, or disaster recovery.
10. Automated decision-making
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR.
11. International data transfers
Kladero’s primary hosting infrastructure is located within the European Union. Some of our service providers may process personal data outside the European Economic Area (EEA).
Where personal data is transferred to a country for which the European Commission has adopted an adequacy decision, we rely on that adequacy decision. Where no applicable adequacy decision exists, we use appropriate safeguards in accordance with Article 46 GDPR, in particular the European Commission’s Standard Contractual Clauses.
Further information about the safeguards applicable to a particular transfer, including information on how to obtain a copy of the relevant safeguards, may be requested from us using the contact details provided in this Privacy Policy.
12. Changes to this Privacy Policy
We may amend this Privacy Policy to reflect changes in applicable law, our services, or our processing activities.
The current version of this Privacy Policy is available on our website. Where a change materially affects the processing of your personal data or your rights, we will inform you before the change takes effect. Where a change requires your consent, we will request your consent before carrying out the relevant processing.
13. Information about minors
Our websites, products, and services are intended for persons aged 18 or older and are not directed to minors.
We do not knowingly collect personal data from persons under the age of 18. If we become aware that we have collected personal data from a minor, we will take appropriate steps to delete it, unless we are legally required or otherwise permitted to retain it.
If you believe that we may have collected personal data from a person under the age of 18, please contact us using the privacy contact details provided in this Privacy Policy.
14. Language
This Privacy Policy may be made available in multiple languages. In the event of any inconsistency between the English version and a translated version, the English version shall prevail.