Privacy Policy

Personal data (usually referred to just as “data” below) will only be processed by us to the extent necessary and for the purpose of providing a functional and user-friendly website, including its contents, and the services offered there.

Per Art. 4 No. 1 of Regulation (EU) 2016/679, i.e. the General Data Protection Regulation (hereinafter referred to as the “GDPR”), “processing” refers to any operation or set of operations such as collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment, or combination, restriction, erasure, or destruction performed on personal data, whether by automated means or not.

The following privacy policy is intended to inform you in particular about the type, scope, purpose, duration, and legal basis for the processing of such data either under our own control or in conjunction with others. We also inform you below about the third-party components we use to optimize our website and improve the user experience which may result in said third parties also processing data they collect and control.

Our privacy policy is structured as follows:

I. Information about us as controllers of your data
II. The rights of users and data subjects
III. Information about the data processing

I. Information about us as controllers of your data

The party responsible for this website (the “controller”) for purposes of data protection law is:

kiutra GmbH
Flößergasse 2
81369 Munich
Germany
Phone: +49 89 35647977-0
Email: info@kiutra.com

The controller has appointed an external data protection officer. You can contact the data protection officer directly on any matter relating to the processing of your personal data and the exercise of your rights:

Ascon-Datenschutz GmbH & Co. KG
Stefan Auer
Lina-Ammon-Str. 19
90471 Nuremberg
Germany
Phone: +49 911 148986-50
Email: office@ascon-datenschutz.de

II. The rights of users and data subjects

With regard to the data processing to be described in more detail below, users and data subjects have the right

• to confirmation of whether data concerning them is being processed, information about the data being processed, further information about the nature of the data processing, and copies of the data (cf. also Art. 15 GDPR);
• to correct or complete incorrect or incomplete data (cf. also Art. 16 GDPR);
• to the immediate deletion of data concerning them (cf. also Art. 17 GDPR), or, alternatively, if further processing is necessary as stipulated in Art. 17 Para. 3 GDPR, to restrict said processing per Art. 18 GDPR;
• to receive copies of the data concerning them and/or provided by them and to have the same transmitted to other providers/controllers (cf. also Art. 20 GDPR);
• to withdraw consent at any time with effect for the future, where the processing is based on consent; the lawfulness of the processing carried out on the basis of the consent up to the withdrawal remains unaffected (cf. also Art. 7 Para. 3 GDPR);
• to file complaints with the supervisory authority if they believe that data concerning them is being processed by the controller in breach of data protection provisions (cf. also Art. 77 GDPR).

In addition, the controller is obliged to inform all recipients to whom it discloses data of any such corrections, deletions, or restrictions placed on processing the same per Art. 16, 17 Para. 1, 18 GDPR. However, this obligation does not apply if such notification is impossible or involves a disproportionate effort. Nevertheless, users have a right to information about these recipients.

Likewise, under Art. 21 GDPR, users and data subjects have the right to object to the controller’s future processing of their data pursuant to Art. 6 Para. 1 lit. f) GDPR. In particular, an objection to data processing for the purpose of direct advertising is permissible.

The relevant supervisory authority for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 27
91522 Ansbach
Germany

III. Information about the data processing

Your data processed when using our website will be deleted or blocked as soon as the purpose for its storage ceases to apply, provided the deletion of the same is not in breach of any statutory storage obligations or unless otherwise stipulated below.

Server data

For technical reasons, the following data sent by your internet browser to us or to our server provider will be collected, especially to ensure a secure and stable website:

These server log files record the type and version of your browser, operating system, the website from which you came (referrer URL), the webpages on our site visited, the date and time of your visit, as well as the IP address from which you visited our site.

The data thus collected will be temporarily stored, but not in association with any other of your data.

Our website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, which acts as a processor on our behalf under a data processing agreement pursuant to Art. 28 GDPR. The data is processed exclusively on servers located within the European Union.

The basis for this storage is Art. 6 Para. 1 lit. f) GDPR. Our legitimate interest lies in the improvement, stability, functionality, and security of our website.

The data will be deleted within six weeks, unless continued storage is required for evidentiary purposes. In that case, all or part of the data will be excluded from deletion until the investigation of the relevant incident is finally resolved.

Order processing

If you order goods or services from us, for example after receiving a quote, we process the data you provide in order to enter into and perform the contract. Please note that we cannot process your order without this data.

The legal basis for this processing is Art. 6 Para. 1 lit. b) GDPR.

In order to process your order, we will share your data with the shipping company responsible for delivery to the extent required to deliver your order and/or with the payment service provider to the extent required to process your payment.

The legal basis for the transfer of this data is Art. 6 Para. 1 lit. b) GDPR.

Some of our distributors are located outside the European Economic Area. For Japan and the Republic of Korea, the European Commission has adopted an adequacy decision (Art. 45 GDPR). For Taiwan, which is not covered by an adequacy decision, we rely on Standard Contractual Clauses adopted by the European Commission (Art. 46 Para. 2 lit. c) GDPR) to ensure your data is adequately protected.

You can request a copy of the relevant safeguards by contacting us at info@kiutra.com.

Contact

If you contact us via email or one of our contact forms, the data you provide will be used for the purpose of processing your request. We must have this data in order to process and answer your inquiry; otherwise we will not be able to answer it in full or at all.

The data you enter in our contact forms (name, email address, your message and, where entered, your company/institution) is transmitted to our web server and forwarded from there by email to our sales team (sales@kiutra.com) or our info team (info@kiutra.com), depending on the page you send it from. It is not stored in a database on the website.

Our email system is Microsoft 365, provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, which acts as our processor under a data processing agreement pursuant to Art. 28 GDPR. Form messages are sent via the Microsoft Graph interface and stored in our Microsoft 365 mailboxes, as are emails you send us directly. Where data is transferred to Microsoft Corporation in the United States, the transfer is based on its certification under the EU-U.S. Data Privacy Framework and the corresponding adequacy decision (Art. 45 GDPR) and, in addition, on Standard Contractual Clauses (Art. 46 Para. 2 lit. c) GDPR).

When submitting a form, you are asked to confirm that you have read this privacy policy. Our contact forms do not include a newsletter or marketing opt-in.

The legal basis for processing your inquiry is Art. 6 Para. 1 lit. b) GDPR where the inquiry relates to a contract with us or to pre-contractual measures, and otherwise Art. 6 Para. 1 lit. f) GDPR; our legitimate interest lies in answering inquiries addressed to us.

For each contact or download request we forward, our server records a technical log entry (time, reference number, page, form type, receiving mailbox, whether delivery succeeded and, if not, the technical error message), without your name, email address or message. These entries are deleted after 90 days. Legal basis: Art. 6 Para. 1 lit. f) GDPR; our legitimate interest lies in verifying that form messages are delivered and fixing delivery errors.

To protect our forms and configurators against abuse, we store a hashed value derived from your IP address for about ten minutes when you submit a form or a quote request. Legal basis: Art. 6 Para. 1 lit. f) GDPR; our legitimate interest lies in preventing spam and misuse of our forms and configurators.

Measurement configurators (quote requests)

For our measurement services we offer online configurators that calculate an indicative price. If you request a quote, we process your first and last name, email address, the company/institution and notes you enter, and the configuration you selected.

The request is sent by email (Microsoft 365, see “Contact”) to our sales team (sales@kiutra.com). You also receive a copy of your request, including your configuration, the indicative price and your notes, at the email address you entered. The request is not stored in a database on the website. Only if sending fails does our server record a reference number, the time, the configurator used, which of the two emails failed (to our team or your copy) and the technical error message, without your name or email address. These entries are deleted after 90 days.

Legal basis: Art. 6 Para. 1 lit. b) GDPR (pre-contractual measures taken at your request).

Material downloads

Some documents (e.g. white papers, posters, installation requirements) are provided after you complete a short form. We collect your name, email address and, if entered, your company/institution, and forward them by email (Microsoft 365, see “Contact”) to our info team (info@kiutra.com) in order to provide the requested document.

The document is served from our own web server. The data is not used to contact you about our products and services.

Legal basis: Art. 6 Para. 1 lit. b) GDPR (providing the requested document).

Online job applications / publication of job advertisements

We offer you the opportunity to apply for jobs with our company via our website. For this purpose, we use the recruiting platform Personio, operated by Personio SE & Co. KG, Seidlstraße 3, 80335 Munich, Germany. When you click on a job ad, you will be redirected to our application page hosted on Personio’s servers.

Your application data will be collected and processed electronically via Personio in order to manage the application process. We remain the data controller; Personio acts as a processor on our behalf under a data processing agreement pursuant to Art. 28 GDPR. For more information on how Personio handles data, please refer to their privacy policy.

The legal basis for this processing is Art. 6 Para. 1 lit. b) GDPR (steps taken prior to entering into an employment relationship), supplemented by § 26 Para. 1 Sentence 1 BDSG in conjunction with Art. 88 GDPR.

If you are hired as a result of the application process, we will store the data you provide during the application process in your personnel file for the purpose of the usual organizational and administrative procedures, in compliance with applicable legal obligations.

The legal basis for this processing is Art. 6 Para. 1 lit. b) GDPR in conjunction with § 26 Para. 1 Sentence 1 BDSG.

If we do not hire you, we will automatically delete the data submitted to us six months after the final decision has been communicated to you. We will not delete the data, however, if we must retain it for legal reasons (e.g. evidence of equal treatment of applicants), or until any legal claims have been finally resolved.

The legal basis in this case is Art. 6 Para. 1 lit. f) GDPR and § 24 Para. 1 No. 2 BDSG. Our legitimate interest lies in defending against possible legal claims.

If you expressly consent to longer storage of your data (e.g. inclusion in a pool of applicants or interested parties), we will store your data accordingly. The legal basis is then Art. 6 Para. 1 lit. a) GDPR. You can withdraw your consent at any time with future effect pursuant to Art. 7 Para. 3 GDPR.

Whistleblowing

We provide a whistleblowing channel via Personio SE & Co. KG, Seidlstraße 3, 80335 Munich, Germany, through which you can report compliance concerns, misconduct or legal violations, also anonymously. Reports are submitted via a separate platform hosted on Personio’s servers: kiutra.personiowhistleblowing.com. Personio acts as our processor under a data processing agreement pursuant to Art. 28 GDPR.

Data processed depends on what you submit and whether you choose to identify yourself; this may include your report content and, if provided, your contact details. Access to reports is restricted to authorized personnel only, in order to protect the confidentiality of your identity and any individuals mentioned in your report.

The legal basis for this processing is Art. 6 Para. 1 lit. c) GDPR (legal obligation under the German Whistleblower Protection Act — Hinweisgeberschutzgesetz, HinSchG) and, where applicable, Art. 6 Para. 1 lit. f) GDPR (legitimate interest in investigating reported concerns).

Documentation relating to a report is deleted three years after the conclusion of the procedure, unless a longer retention period is necessary in order to comply with legal obligations or to establish, exercise or defend legal claims (§ 11 Para. 5 HinSchG).

Personio’s privacy policy

LinkedIn

We maintain an online presence on LinkedIn to present our company and our services and to communicate with customers/prospects. LinkedIn is a service of LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland, a subsidiary of LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA.

With regard to the processing of statistical data on the use of our LinkedIn company page (Page Insights), we and LinkedIn Ireland Unlimited Company act as joint controllers within the meaning of Art. 26 GDPR. The essential content of the joint controller arrangement is available from LinkedIn. You may exercise your rights as a data subject against either us or LinkedIn.

We also use the LinkedIn Insight Tag on our website. It sets cookies and transmits your IP address, browser information, the pages visited and conversion events to LinkedIn, which uses them for conversion tracking and to build audiences for ads on LinkedIn (retargeting). The tag is only activated after you have consented to both the Statistics and the Marketing categories in our cookie banner (see “Google Tag Manager”). Legal basis: § 25 Para. 1 of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Art. 6 Para. 1 lit. a) GDPR (consent).

Data may be transferred to LinkedIn Corporation in the United States. Such transfers are based on its certification under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and, in addition, on Standard Contractual Clauses (Art. 46 Para. 2 lit. c) GDPR).

The LinkedIn privacy policy can be found here.

Cookie consent management

We use the consent management platform Cookiebot, provided by Usercentrics A/S, Havnegade 39, 1058 Copenhagen K, Denmark. To display the cookie banner, the Cookiebot script is loaded from Cookiebot’s servers when you open our website; this transmits your IP address and browser information to Usercentrics and its content delivery network provider in the EU (BunnyWay d.o.o., Slovenia).

Your choice is stored in a cookie on your device (“CookieConsent”, 12 months) and, to document your consent, a consent record (consent ID, date and time, anonymized IP address, browser information, page URL and your choice) is stored on Cookiebot’s servers. The consent record is deleted after 12 months. Legal basis: Art. 6 Para. 1 lit. c) GDPR in conjunction with Art. 7 Para. 1 GDPR; storing the consent cookie is strictly necessary (§ 25 Para. 2 No. 2 TDDDG).

Cookies and similar technologies that are not strictly necessary are only used with your consent. The storage of information on your terminal equipment and any access to information already stored on it take place on the basis of your consent pursuant to § 25 Para. 1 TDDDG, unless such storage or access is strictly necessary in order to provide a service which you have expressly requested (§ 25 Para. 2 No. 2 TDDDG). Any subsequent processing of personal data obtained in this way is governed by the GDPR on the legal bases set out for each service below.

Cookie categories

We use the following cookie categories:

Necessary cookies

Necessary cookies are required for the basic operation and security of the website. They enable core functions such as page navigation and consent management. These cookies cannot be disabled.

Preferences cookies

Preference cookies allow a website to remember information that affects how the website behaves or looks, such as language or regional settings. These cookies are only used if you give your consent.

Statistics cookies

Statistics cookies help us understand how visitors use our website, for example which pages are visited. These cookies are only used if you give your consent.

Marketing cookies

Marketing cookies are used to track visitors across websites in order to display ads that are relevant to individual users and to measure the effectiveness of advertising campaigns.

We actively use marketing/advertising trackers (Google Ads, LinkedIn Insight Tag). These are only set after you have consented to both the Statistics and the Marketing categories in our cookie banner (see “Google Tag Manager”).

Cookie declaration and cookie settings

Details about the individual cookies used, including their purpose, storage duration, and providers, are available in the Cookie Declaration. The Cookie Declaration and cookie settings can be accessed at any time via the cookie settings button displayed on the website. You can change or withdraw your consent at any time. The lawfulness of processing based on consent before its withdrawal remains unaffected.

Google Tag Manager

We use Google Tag Manager, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is used to manage the tags of the services described below. It is loaded only after you have consented to the “Statistics” category in our cookie banner. When it loads, your browser connects to Google’s servers, which transmits your IP address and browser information to Google. Each tag managed through it is subject to the consent requirements stated for that service. Legal basis: your consent (§ 25 Para. 1 TDDDG, Art. 6 Para. 1 lit. a) GDPR). Data may be transferred to Google LLC in the United States; Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

Further information on data processing by Google can be found in Google’s privacy policy.

Google Analytics

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics is used to analyze how our website is used, for example which pages are visited and how users interact with our content. This helps us improve our website and better understand which content is relevant to our visitors.

Google Analytics may process the following data:

• IP address (in anonymized form)
• Device and browser information
• Pages visited and interactions
• Referrer URLs
• Approximate location (region)

Event-level data in Google Analytics is retained for 14 months; user-level data is retained for 14 months after your last visit. Both are then deleted automatically.

Data may be transferred to servers of Google LLC in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, so that transfer takes place on the basis of the European Commission’s adequacy decision (Art. 45 GDPR); in addition, Google relies on the Standard Contractual Clauses adopted by the European Commission (Art. 46 Para. 2 lit. c) GDPR). The legal basis for this processing is Art. 6 Para. 1 lit. a) GDPR (consent).

Google Analytics is only activated if you have given your explicit consent via our cookie banner (Statistics category). You can revoke your consent at any time via the cookie settings button displayed on the website.

If you have also consented to the Marketing category, data from Google Analytics is shared with our Google Ads account to measure conversions (see “Google Ads”).

Further information:
policies.google.com/privacy
support.google.com/analytics

Google Ads

We use Google Ads conversion tracking and remarketing, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This allows us to measure the effectiveness of our advertising campaigns and to show you relevant ads based on your previous visits to our website (remarketing).

Data processed: cookie ID, pages visited, actions taken (e.g. form submissions, downloads).

Data may be transferred to servers of Google LLC in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, so that transfer takes place on the basis of the European Commission’s adequacy decision (Art. 45 GDPR); in addition, Google relies on the Standard Contractual Clauses adopted by the European Commission (Art. 46 Para. 2 lit. c) GDPR).

Google Ads tracking is only activated after you have consented to both the Statistics and the Marketing categories in our cookie banner (see “Google Tag Manager”).

The legal basis for this processing is Art. 6 Para. 1 lit. a) GDPR (consent).

Further information can be found in Google’s privacy policy.

Vimeo

We use Vimeo to embed selected videos on our website. The service is provided by Vimeo.com, Inc., 330 W 34th Street, New York, NY 10001, USA.

Embedded Vimeo videos are initially shown only as a preview image hosted on our own server. No connection to Vimeo is established until you click play. When you click play, your browser connects to Vimeo’s servers and Vimeo may set cookies.

Data processed: IP address, device and browser information, viewing behavior, unique player and session identifiers.

Data may be transferred to the United States. Vimeo.com, Inc. is certified under the EU-U.S. Data Privacy Framework, so the transfer takes place on the basis of the European Commission’s adequacy decision (Art. 45 GDPR).

The legal basis is your consent, given by clicking play (§ 25 Para. 1 TDDDG, Art. 6 Para. 1 lit. a) GDPR). If you do not want data to be transmitted to Vimeo, do not start the video.

Further information can be found in Vimeo’s privacy policy.

Some videos on our website are self-hosted and do not involve Vimeo or any other third party.

Status of this privacy policy: October 2026.