Privacy Policy

01

Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

We have not appointed an external data protection officer, as there is no legal obligation to do so.

02

Basics & legal bases

We process personal data only to the extent necessary and on the basis of the GDPR. Depending on the processing, we rely on: consent (Art. 6(1)(a)), performance of a contract or pre-contractual measures (lit. b), legal obligation (lit. c) and legitimate interest (lit. f).

Personal data is any information relating to an identified or identifiable natural person.

03

Hosting (IONOS)

This website is hosted by the German provider IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany). On our behalf, IONOS processes the data generated via the website (incl. access data, server log files, content of input fields). Processing takes place on servers in Germany or within the EU; as a rule, no transfer to third countries occurs.

The legal basis is our legitimate interest in the secure and efficient provision of our offering (Art. 6(1)(f) GDPR). A data processing agreement (DPA) pursuant to Art. 28 GDPR has been concluded with IONOS.

04

Server log files

When you access the website, information transmitted by your browser is automatically collected (so-called server log files): browser type and version, operating system used, referrer URL, host name of the accessing computer, time of the server request and IP address.

This data is not merged with other data sources. Collection is based on Art. 6(1)(f) GDPR for the technically error-free presentation and security of our website. Storage takes place only for as long as necessary.

05

SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” and the lock symbol in your browser bar.

06

Contact & contact form

If you contact us by email or via the contact form, we process the data you provide (e.g. name, email address, content of the message) in order to handle your enquiry.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures/contract), otherwise our legitimate interest in responding (lit. f). The data is deleted as soon as it is no longer required for the purpose and no statutory retention obligations apply.

Email mailbox: Incoming enquiries are received and stored in our email mailbox at Google (Google Workspace; Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google processes this data on our behalf on the basis of a data processing agreement (Art. 28 GDPR). Any processing in the USA is carried out on the basis of appropriate safeguards (EU Standard Contractual Clauses or the EU-US Data Privacy Framework).

07

Appointment booking (meetergo)

To book a free intro call, we have embedded meetergo on this website. The provider is meetergo GmbH, Hauptstr. 44, 40789 Monheim am Rhein, Germany (hereinafter “meetergo”). meetergo provides an online appointment-scheduling tool. The booking calendar is only loaded on our page once you actively click “Load calendar & book”. Before this click, no connection to meetergo is established and no data is transferred to meetergo.

When you book an appointment with us online, the data you enter for this purpose (name, email address, preferred time, any phone number and message) is stored on meetergo’s servers in Germany. In addition, meetergo briefly records your IP address, your referrer URL and the time of access, and can determine that you have made a request to us; this data is used exclusively for the technical provision of the service and is then automatically deleted again.

The use of meetergo is based on Art. 6(1)(f) GDPR. The website operator has a legitimate interest in making appointment scheduling as straightforward as possible. As the calendar is only loaded after your active click, we additionally obtain your consent for this; in that case processing is based on Art. 6(1)(a) GDPR (or Art. 9(1)(a) GDPR). Consent can be withdrawn at any time with effect for the future. As meetergo is a German provider, processing takes place within the EU; no transfer to the USA occurs. A data processing agreement (DPA) pursuant to Art. 28 GDPR has been concluded with meetergo. meetergo’s privacy policy applies in addition.

08

Web fonts (self-hosted)

For a consistent presentation of typefaces, this website uses the fonts Inter and Michroma. These are served locally from our own server (self-hosted on the IONOS web space). No connection to Google servers is established and no personal data (in particular no IP address) is transferred to Google.

The fonts are licensed under the SIL Open Font License and are loaded exclusively from this website.

09

Cookies

Our website uses cookies as sparingly as possible. Technically necessary cookies (e.g. for the secure operation of the site via IONOS) are set on the basis of Art. 6(1)(f) GDPR and Section 25(2) TDDDG. Non-essential cookies (e.g. statistics/marketing) are only set with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).

Our basic statistics count page views without cookies, without storing anything on your device and without a visitor identifier. Only totals are stored: views per page and hour, and separate daily totals per language, device category, window size (small/medium/large) and source type (direct, search engine, social network, other website); the default retention is 365 days. Advanced statistics start only after your consent. They record individual events on our server such as page views, visible and active time, scroll depth, clicks on navigation, buttons and e-mail, phone and external links, opened FAQ entries, video playback and the steps of the contact form (never its contents), and for page views also language, device, browser and operating-system category with major version, rounded window width, touch use, colour scheme, referring domain and – if enabled – the country or region derived from the IP address. Events of one visit are linked by a random session identifier in the browser tab's session storage that expires after 30 minutes of inactivity. Data is kept for at most 90 days by default. Neither level stores IP addresses, full referrer URLs or persistent visitor identifiers. Withdrawal stops future advanced events and deletes the session identifier; basic counts are independent of this choice.

If Google Analytics is used, it is listed as a separate service in the cookie settings and is loaded only after your consent. Your IP address, device and browser information, pages viewed and interactions are then transmitted to Google Ireland Limited; a transfer to Google LLC (USA) is possible. Google sets cookies (_ga, _ga_<ID>) lasting up to 13 months. Google Signals and advertising features are disabled. Withdrawal stops the measurement and deletes these cookies on our domain.

The meetergo booking calendar is only loaded after your active click; any cookies set by meetergo therefore also only arise after your consent. You can find a detailed list in our cookie policy.

You can withdraw your consent at any time with effect for the future and manage cookies in your browser settings.

The specific cookie list is provided in the cookie policy. Advanced statistics and any external statistics service are activated only after consent; basic counts are independent of that choice.

10

AI tools in service delivery

As part of our service (creating AI films and avatars) we use AI tools. These do not process the data of website visitors, but the content provided within a commission (e.g. images, voices, scripts). Providers used:

• HeyGen (HeyGen Inc., USA) — avatar videos. Data transfer based on EU Standard Contractual Clauses.
• ElevenLabs (ElevenLabs Inc., USA — EU data residency available) — voice synthesis/voice cloning.
• fal.ai (fal.ai Inc., USA) — image and video generation (incl. Nano Banana, Seedance, Kling, Veo). Standard Contractual Clauses.
• Others: Higgsfield, OpenArt, Freepik AI (EU), Midjourney, Claude (Anthropic).

Where personal data is processed for this purpose, it is done on the basis of a data processing agreement (Art. 28 GDPR) and — for voice/image use of identifiable persons — only with explicit written consent. Details: AI transparency page.

11

Your rights

Under the GDPR you have the following rights:

• Access (Art. 15), rectification (Art. 16) and erasure (Art. 17).
• Restriction of processing (Art. 18) and data portability (Art. 20).
• Objection to processing (Art. 21) and withdrawal of consent given, with effect for the future (Art. 7(3)).
• Complaint to a supervisory authority (Art. 77).

Competent supervisory authority: State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW), Düsseldorf. To exercise your rights, a message to info@kiavatars.com is sufficient.

12

Storage period & changes

We store personal data only for as long as is necessary for the respective purposes or as required by statutory retention periods (e.g. under commercial and tax law). After that, the data is deleted.

We adapt this privacy policy whenever changes to data processing or the legal situation make it necessary. The version published on this page applies.