Your data.
Clearly explained.
Here is how data is processed when you visit our website, make an enquiry or book an introductory call.
1. Optional Google Analytics measurement
With your consent, we measure page views and selected contact actions on kluk.digital using Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Technical device and browser data, cookie identifiers, page paths and events are processed. Your IP address is technically transmitted to Google. Processing may also take place in the USA. See Google's privacy policy and data processing terms.
The legal basis is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. No Google analytics tag loads before consent. Our analytics parameters do not contain form contents, names, email addresses or telephone numbers. We remove query strings and fragments from the page URLs we set. Enhanced measurement and advertising personalisation are disabled. An accepted enquiry event means the enquiry was stored, not that an email was delivered or a sale completed.
The Analytics account retains event data for two months and user data for 14 months, with the user-data period currently reset on new activity. This setting does not cover all aggregated standard reports. Analytics cookies are configured for up to 60 days. Your choice is stored locally for up to 180 days so that we can respect it. Use “Analytics settings” in the footer to reject or withdraw consent for the future. We then stop measurement, delete accessible Google Analytics cookies for this domain and reload the page. This does not retroactively delete data already lawfully transmitted. Contact us for further privacy requests. Our analytics transmission is disabled on review and local previews.
2. Controller
KLUK Hoffmann & Serraj GbR, Römerstraße 11, 56745 Weibern, Germany. Represented by Joshua Hoffmann and Omar Serraj. For privacy enquiries: kontakt@kluk.info.
3. Visiting and hosting the website
Cloudflare processes technical data such as IP address, time, requested URL, browser information and error data. Our public website, enquiry form and protected administration area run in our Cloudflare account. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Processing supports delivery, stability and security (Article 6(1)(f) GDPR). Data may be processed internationally, including in the USA, under the Cloudflare data processing terms and their transfer mechanisms. Google Analytics loads only with consent. See Cloudflare privacy information and data processing terms.
4. Project enquiries and introductory calls
When you submit an enquiry or book a call, we process your name, business, email, optional phone number, selected services, project description, language, timestamps and appointment. This helps us prepare and conduct the call and respond to your enquiry. The legal basis is Article 6(1)(b) GDPR for a potential engagement and Article 6(1)(f) GDPR for other business enquiries.
Records are stored in Cloudflare D1. The technical provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. We do not promise exclusively European processing. Cloudflare describes international safeguards in its data processing agreement and privacy policy.
Web-form records become due for deletion 180 days after their last status change, once any related appointment is in the past. Cleanup runs when availability or the administration area is next accessed. You may request earlier deletion. Business correspondence and legally required records are handled separately.
5. Notifications and email
After saving the record, your browser sends a notification through Web3Forms, a service of Web3Creative. It receives a record reference, any appointment time, an administration link and technical metadata. Your name, phone number and project description remain in the protected administration area. An enquiry remains saved if the notification fails. We arrange conversations personally after your enquiry. We display detected notification errors.
Web3Forms states that it operates from India using international infrastructure and further service providers. It describes EU Standard Contractual Clauses as a transfer mechanism and a maximum physical retention of three years for submissions unless deleted earlier. See Web3Forms privacy and its data processing agreement.
Our mailbox uses IONOS. If you email us directly, we process your address, message and transmission data for the same purposes and on the same legal bases. See IONOS privacy information.
6. Spam protection
We protect record creation with a locally served ALTCHA computational challenge. Your browser solves it and our server verifies the answer. No ALTCHA account or transfer to an ALTCHA service is required. We also limit attempts using temporarily stored IP and email identifiers hashed with a secret key. Our legitimate interest in preventing abuse is the legal basis (Article 6(1)(f) GDPR). Counters expire within 24 hours and are deleted at the next cleanup.
For email delivery, we load hCaptcha and the Web3Forms script only when you select “Load spam protection”. hCaptcha may then process IP address, device, browser and interaction data and technical identifiers, and use cookies or similar technologies. Its provider is Intuition Machines, Inc., 1065 SW 8th Street #704, Miami, FL 33130, USA. Processing may occur in the USA and other countries.
Activation is based on your consent (Article 6(1)(a) GDPR and Section 25(1) TDDDG) for the current page visit. You may close or reload the page to stop using the service and contact us by email instead. Withdrawal applies for the future. See hCaptcha’s privacy policy for data, transfers and safeguards.
7. Fonts, preferences and team access
Fonts and visual assets are served with the website, without contacting an external font provider. Motion preferences apply only to the current page and are not stored permanently.
Signing into the protected team area sets the necessary cookie “__Host-kluk_admin” for up to eight hours. It is Secure, HttpOnly and SameSite=Strict and is deleted on logout. The session is also revoked on the server. It serves access control only (Article 6(1)(f) GDPR; Section 25(2)(2) TDDDG). Public visitors do not receive this cookie.
8. Eifel study and external links
The exploratory Eifel study questionnaires open separately on LimeSurvey. The young-person and business questionnaires are anonymous; contact details for the results report are collected separately. Each questionnaire has its own participation and privacy information. The study is independently conducted by KLUK. External links transfer data when you open the other website.
9. Your rights
Subject to the GDPR, you have rights to access, rectification, erasure, restriction, portability and objection. You may withdraw consent for the future. We do not make solely automated decisions about your enquiry with legal or similarly significant effects.
Contact kontakt@kluk.info. You may also complain to a supervisory authority, particularly the Commissioner for Data Protection and Freedom of Information Rhineland-Palatinate, Hintere Bleiche 34, 55116 Mainz: datenschutz.rlp.de.