This policy covers kroener.digital — the marketing pages and the applications behind the sign-in. It is a different document from the policy for oliver-kroener.de, because this platform uses different services.
Controller
The controller for data processing on this website is:
Oliver Kröner
Ziegelei 5
73765 Neuhausen a.d.F.
Telephone: +49 7158 9809940
Email: privacy@kroener.digital
The controller is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data (e.g. names, email addresses and the like).
General information
We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection provisions and this privacy policy.
When you use this website, various personal data are collected. Personal data are data by which you can be personally identified. This policy explains which data we collect and what we use them for, as well as how and for what purpose that happens.
We point out that data transmission over the internet (e.g. communication by email) can have security gaps. Complete protection of data against access by third parties is not possible.
Hosting
We host this platform with netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany. The servers are located in Germany. Details can be found in netcup's privacy policy at https://www.netcup.com/de/kontakt/datenschutzerklaerung.
netcup is used on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in presenting this platform as reliably as possible. We have concluded a data processing agreement (DPA) for the use of this service — a contract required by data protection law which ensures that the provider processes personal data only according to our instructions and in compliance with the GDPR.
Server log files
The provider of these pages automatically collects and stores information in server log files, which your browser transmits automatically. These are: browser type and version, operating system used, referrer URL, host name of the accessing computer, time of the server request and IP address. These data are not merged with other data sources.
The collection of these data is based on Art. 6(1)(f) GDPR. The operator has a legitimate interest in the technically error-free presentation and optimisation of the platform, for which the server log files must be recorded.
Cookies
This platform uses cookies that are technically necessary and nothing else. They hold your session after sign-in, the language you have chosen, and the security token that protects forms against cross-site request forgery. There are no analytics, advertising or third-party cookies, which is why you are not asked for consent — necessary cookies are stored on the basis of Art. 6(1)(f) GDPR.
You can set your browser to inform you about the setting of cookies, to allow cookies only in individual cases, to exclude their acceptance generally, and to activate automatic deletion of cookies when the browser is closed. If you disable cookies, you will not be able to sign in and the applications will not work.
No third-party requests, no tracking
Loading a page of this platform fetches nothing from any other company: no external fonts, no scripts from a content delivery network, no embedded maps, videos or social media buttons, and no analytics tool. Your IP address is therefore not disclosed to any third party by the act of viewing a page, and there is no consent banner because there is nothing to consent to.
User accounts and sign-in
To use the applications you need an account. It is held in our own identity service, which runs on the same servers in Germany as the rest of the platform — no external identity provider is involved and no social login is offered.
We process your name, email address, the organisation you belong to and your role within it, together with sign-in timestamps. The legal basis is Art. 6(1)(b) GDPR, because these data are necessary to perform the contract with the organisation you work for. Passwords are stored only as cryptographic hashes and cannot be read by us.
Administrators of our own organisation can, for support purposes, view the platform in the name of another user. Such a session is read-only and every write is refused by the system, and it is visibly marked in the interface for as long as it lasts.
Data you enter into the applications
Everything your organisation enters into the applications — subscriptions, calculations, assessments, business card details, scheduled messages and mailbox credentials — is processed by us on behalf of your organisation under Art. 28 GDPR. Your organisation is the controller for these data and decides what is entered, who may see it and when it is deleted; we act only on its instructions.
If you are an employee of a customer and want to know what is stored about you, or want it corrected or deleted, please contact your own organisation first — we are obliged to refer such requests to it.
Deleting a record hides it and records who deleted it and when, so that an administrator of your organisation can restore it. Final, irreversible removal is carried out by us on request.
Access by AI assistants
If your organisation licenses and switches on the MCP server, an AI assistant of your choosing can read and, where you permit it, change your organisation's data. This is off by default: as long as no permissions are set, nothing is granted, not even reading.
What happens to data once your assistant has retrieved them is governed by the privacy policy of whoever provides that assistant, not by this one — you choose that provider, and we recommend checking their terms before switching the access on. We ourselves train no models on your data and pass no data to any model provider.
Enquiries by email or telephone
If you contact us by email or telephone, your enquiry including all personal data arising from it (name, enquiry) will be stored and processed by us for the purpose of handling your request. We do not pass these data on without your consent.
Processing is based on Art. 6(1)(b) GDPR where your enquiry relates to the performance of a contract or to pre-contractual measures. In all other cases it is based on our legitimate interest in effectively handling enquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) where this was requested; consent may be withdrawn at any time.
The data you send us remain with us until you ask us to delete them, withdraw your consent to storage, or the purpose for storing them ceases to apply. Mandatory statutory provisions — in particular retention periods — remain unaffected.
There is no contact form on this platform, so no data are collected before you have decided to write to us.
Storage period
Unless a more specific storage period is stated within this policy, your personal data remain with us until the purpose for processing them ceases to apply. If you make a legitimate request for deletion or withdraw consent to processing, your data will be deleted unless we have other legally permissible grounds for storing them (e.g. retention periods under tax or commercial law); in the latter case deletion takes place once those grounds cease to apply.
Legal bases for processing
Where you have consented to processing, we process your personal data on the basis of Art. 6(1)(a) GDPR. Where your data are required to perform a contract or to carry out pre-contractual measures, we process them on the basis of Art. 6(1)(b) GDPR. Where processing is necessary to comply with a legal obligation, we rely on Art. 6(1)(c) GDPR. Processing may also take place on the basis of our legitimate interest under Art. 6(1)(f) GDPR. The legal basis applicable in each case is stated in the relevant section above.
Recipients of personal data
In the course of our business activities we work with external parties. Personal data are passed to them only where this is necessary to perform a contract, where we are legally obliged to do so, where we have a legitimate interest under Art. 6(1)(f) GDPR, or where another legal basis permits it. Where processors are used, we pass on personal data only on the basis of a valid data processing agreement.
For this platform there is one such processor: netcup GmbH, which provides the servers. No personal data are transferred to a third country outside the European Union.
Your rights
Within the scope of the applicable law you have the right at any time to free information about your stored personal data, their origin and recipients and the purpose of processing, and where applicable a right to have those data corrected or deleted. You have the right to request restriction of processing, and the right to have data we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. Many processing operations are only possible with your express consent, which you may withdraw at any time; the lawfulness of processing carried out until withdrawal is unaffected. For these and any further questions on the subject of personal data you can contact us at any time.
Right to object (Art. 21 GDPR)
IF PROCESSING IS BASED ON ART. 6(1)(e) OR (f) GDPR, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA ON GROUNDS ARISING FROM YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THOSE PROVISIONS. THE RESPECTIVE LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS THE PERSONAL DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES TO ASSERT, EXERCISE OR DEFEND LEGAL CLAIMS (OBJECTION UNDER ART. 21(1) GDPR).
Right to complain to a supervisory authority
In the event of infringements of the GDPR, data subjects have a right to complain to a supervisory authority, in particular in the member state of their habitual residence, place of work or the place of the alleged infringement. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart. This right exists without prejudice to any other administrative or judicial remedy.
SSL/TLS encryption
For security reasons and to protect the transmission of confidential content, this platform uses SSL/TLS encryption throughout. You can recognise an encrypted connection by the address bar of your browser changing from „http://“ to „https://“ and by the padlock symbol in it. When SSL/TLS encryption is active, the data you transmit to us cannot be read by third parties.
Objection to advertising emails
We hereby object to the use of contact data published under the obligation to provide a legal notice for the purpose of sending unsolicited advertising and information material. We expressly reserve the right to take legal action in the event of the unsolicited sending of advertising information, for example by spam emails.
This is a translation of the German privacy policy. In case of doubt, the German version at /de/datenschutzerklaerung governs.