Privacy

Who is responsible

Lass Khoshnaw, Tapachstr. 71A, 70437 Stuttgart, Germany. Email: hello@khlabs.de. Contact details in full are in the imprint.

What we collect when you visit

Our host records a server log for each request: IP address, date and time, the page requested, the referring page, and your browser and operating system. This is needed to deliver the site and keep it secure, and rests on our legitimate interest under Article 6(1)(f) GDPR. Logs are deleted after [7] days.

Fonts

All typefaces used on this site are served from this site's own server. No font is requested from Google Fonts or any other third party, so no data about your visit reaches one.

Cookies

This site sets no cookies and runs no analytics or tracking. If that changes, this page will say so and you will be asked for consent first where the law requires it.

The enquiry form keeps what you have typed in your browser’s session storage, so that closing the form by accident does not lose it. It stays on your device, is never sent to us on its own, and is gone when you close the tab. That is storage strictly necessary for the function you asked for, so it needs no consent under § 25(2) TDDDG.

The enquiry form

The form asks what kind of project you have in mind, a budget range and a preferred start, and then your name, email address and — if you want to give them — telephone number, company, current website and a description. It also asks whether we should get back to you by email or by phone — anyone who asks for a call gives us a number for it. Beyond that, only the project questions, your name and your email address are required.

We store and use this to answer your enquiry and to follow it up. The basis is Article 6(1)(b) GDPR where it leads to a contract, and Article 6(1)(f) GDPR — our interest in answering people who approach us — otherwise. You give us the tick box separately, and the form does not work without it because we will not store your details without your say-so.

Keeping bots out of the form

Sending the form is rate limited so that one source cannot flood it. For that we hold a shortened IP address — the last block is dropped, so it identifies a network and not a connection — for at most 24 hours, and never store it with your enquiry. The form is also checked by Cloudflare Turnstile, which decides whether the sender is a person without setting a cookie, without a puzzle to solve and without profiling you. Cloudflare Germany GmbH, Rosental 7, 80331 München, acts as our processor under Article 28 GDPR.

Email we send you

We do not send an automatic acknowledgement. The form tells you on screen that your enquiry arrived, and the first thing you hear from us is a reply written by hand. That reply, and any offer or contract email after it, goes from our own mailbox at Microsoft (Microsoft Ireland Operations Ltd., One Microsoft Place, Dublin 18, Ireland), who act as our processor under Article 28 GDPR. Our domain is authenticated with SPF and DKIM, so you can verify that an email claiming to be from us really is.

Booking an appointment

Once your enquiry has been sent you are offered a calendar to book an introductory call. It is provided by Cal.com and loads only at that point — if you do not get that far, nothing is requested from them. Your name and email address are passed on so that you need not type them twice, together with the time you pick. Cal.com acts as our processor under Article 28 GDPR. Booking is optional: your enquiry has already reached us by then and closing the calendar changes nothing.

Offer and contract

If an enquiry leads to an offer, you receive a link to a page of your own on contract.khlabs.de, together with an eight-digit PIN in the same email. The page holds the offer and lets you accept it.

If you accept, we store the name you sign with, your drawn signature if you draw one, the email address you confirm, the time, your IP address and your browser identifier. The last two are not there to track you: without them there is no evidence of who accepted what, and that evidence is the whole point of a signature. The basis is Article 6(1)(b) GDPR, since it concerns the contract itself, and we keep it for as long as commercial retention periods require.

Every attempt to open a contract page is logged with a shortened IP address — successful or not — so that we can see whether anyone other than you has tried. Those entries are deleted after 90 days.

Who else sees your data

Our hosting provider, our email provider [name], Cloudflare and Cal.com process data on our behalf under data processing agreements in line with Article 28 GDPR. Nobody else receives it. We do not sell data and we do not pass it on for advertising.

How long we keep an enquiry

For as long as the matter is open, and afterwards only where retention periods require it. An enquiry that leads nowhere is deleted after twelve months. You can ask us to delete it sooner at any time.

Your rights

You can ask us for access to your data, and for correction, deletion, restriction of processing or a portable copy. You can object to processing based on legitimate interest. Write to the address above and we will respond within a month.

You also have the right to complain to a supervisory authority. For us that is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Stuttgart.

Changes

We update this page when the site changes. Last updated: [date].