Privacy Policy

Kyvera GmbH, Edmund-Rumpler-Straße 5, 51149 Cologne, Germany, is the controller for the processing described here. You reach us at hi@kyvera.com. Managing directors: Marina Ribke, Christian Müller. This policy covers this website; how we handle applications is described in our candidate privacy notice, linked from every application route.

This website collects almost nothing. No tracking, no analytics, no advertising technology, no third-party embeds, and therefore no cookie banner: there is nothing to consent to. What remains is what the internet technically requires, server logs, and what you choose to send us by email. The rest of this policy describes exactly that.

This website is hosted by Vercel Inc., San Francisco, USA, on a global edge network. When you visit, your IP address is processed by our hosting provider to deliver the site and protect it against attacks. It is not visible to us: we have switched off IP address visibility in the Vercel dashboard and in log drains, so no log, query or firewall record we can access contains it. What those records show is date and time, the page requested, the transferring website, your browser and operating system. We use them to deliver the site securely and to detect misuse. Legal basis: our legitimate interest in operating a secure website, Art. 6(1)(f) GDPR. Logs are retained for one day. A data processing agreement under Art. 28 GDPR, incorporating the EU Standard Contractual Clauses, is in place with Vercel; Vercel is additionally certified under the EU-U.S. Data Privacy Framework. See also section 9.

If you write to hi@kyvera.com or any address we publish, we process your email address, the contents of your message and anything you attach, in order to answer you. Legal basis: performance of or preparation for a contract where your enquiry aims at one, Art. 6(1)(b) GDPR, otherwise our legitimate interest in answering the people who write to us, Art. 6(1)(f) GDPR. We keep correspondence as long as the conversation requires, and beyond that only where statutory retention duties apply.

Applications are handled separately and in more detail in our candidate privacy notice, which every application route links to. In short: your application stays with the people hiring and is deleted six months after the process ends, unless you ask us to keep it for future roles.

We do not use cookies that require consent, we do not use analytics, and we do not track visitors. Should a strictly necessary cookie ever be technically required to deliver the site, it is used on the basis of section 25(2) TDDDG and listed here.

We run a company page on LinkedIn (linkedin.com/company/kyverahq). When you visit or follow it, LinkedIn Ireland Unlimited Company, Dublin, processes your data under LinkedIn’s own privacy policy. For the aggregated page statistics LinkedIn provides us, Page Insights, we and LinkedIn are joint controllers under Art. 26 GDPR; the arrangement is LinkedIn’s Page Insights Joint Controller Addendum, and LinkedIn carries the primary responsibility for enabling your data subject rights, which you can exercise directly with LinkedIn. What we receive is aggregated; your individual browsing behaviour on LinkedIn does not reach us. Legal basis for operating the page: our legitimate interest in presenting Kyvera and communicating with the market, Art. 6(1)(f) GDPR. LinkedIn may transfer data to the United States under the safeguards described in its privacy policy.

You have the right to access the personal data we hold about you (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20).

You have the right to object to processing based on legitimate interests (Art. 21 GDPR).

Where processing rests on consent, you may withdraw it at any time with effect for the future. We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR. You also have the right to complain to a supervisory authority; the authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), though you may contact any supervisory authority.

Our hosting provider, Vercel Inc., operates a global infrastructure that includes processing in the United States. These transfers are safeguarded twice: Vercel is certified under the EU-U.S. Data Privacy Framework, and our data processing agreement with Vercel incorporates the EU Standard Contractual Clauses. Email runs on Google Workspace; our contracting party is Google Ireland Limited, Dublin. Where Google processes data in the United States, the transfers are safeguarded by Google LLC’s certification under the EU-U.S. Data Privacy Framework and by the EU Standard Contractual Clauses incorporated in Google’s Cloud Data Processing Addendum. You can request a copy of the safeguards in place at hi@kyvera.com. Beyond the providers named in this policy, we disclose personal data only where a legal obligation requires it.

The site is delivered over TLS-encrypted connections, fonts and assets are served from our own host, and we collect no more than the sections above describe. Data minimisation is not a compliance exercise for us; it is the company’s argument applied to itself.

When the website’s processing changes, this policy changes with it; the effective date above tells you which version you are reading.