Privacy Policy

Effective date: 4 August 2026 · Policy version: 2.1

1. Controller

The controller responsible for data processing on this website is:
KLUGSYS UG (haftungsbeschränkt)
Oppenhoffallee 143, 52066 Aachen, Germany
Email: info@klugsys.com · Phone: +49 174 1641940
Managing Director: Senbaha Karthikeyan Chandrabalan

2. Website delivery through AWS

This website is hosted and delivered using Amazon Web Services (AWS), including Amazon S3 and Amazon CloudFront. When you request a page, technically necessary request data is transmitted to the hosting infrastructure. This can include your IP address, the requested URL, date and time, response status, browser and device information, and referrer information. We process this data to deliver the website, maintain availability, diagnose faults, and protect the service against abuse. The legal basis is our legitimate interest in secure and reliable website operation under Art. 6 (1)(f) GDPR.

Technical request and security data is retained only for as long as it is needed for delivery, fault diagnosis, and security investigation, and is then deleted or anonymised unless a specific incident or legal obligation requires longer retention. AWS's privacy information is available at aws.amazon.com/privacy.

3. Contact enquiries and email

If you contact us, we process the information you provide, such as your name, work email, company, job title, phone number, industry, and message, in order to answer your enquiry. Where your request concerns a contract or steps before entering into a contract, the legal basis is Art. 6 (1)(b) GDPR. For other business enquiries, the legal basis is our legitimate interest in communicating with prospective customers and partners under Art. 6 (1)(f) GDPR.

The current website form prepares a pre-addressed message in your own email application. The website does not transmit the completed form to us automatically; your email is sent only if you complete the send action in that application. Your email provider and the mail servers used by the sender and recipient then process the message as part of email delivery. The required privacy checkbox confirms that you have read this policy. It is not consent to marketing or a separate legal basis for processing your enquiry.

We retain ordinary enquiries while they are being handled and, where needed, for up to three years after the end of the relevant calendar year to establish, exercise, or defend legal claims. If a message forms part of business or tax records that we are legally required to retain, processing during that retention period is based on Art. 6 (1)(c) GDPR in conjunction with the applicable German commercial and tax-law obligations. Those records may have statutory retention periods of six or ten years.

4. Embedded Cal.com booking calendar

The contact page initially shows the email enquiry form and does not contact Cal.com. Selecting the “Book a time” tab directly loads an embedded calendar operated by Cal.com. A demo-intent link only opens the booking panel; it does not contact Cal.com until you select “Load booking calendar” or follow the external-calendar link. Once requested, Cal.com can receive connection and browser data, including your IP address, referrer, device information, and any storage or cookies used by its booking service. A notice and an external-calendar fallback are shown before the embedded calendar is activated.

Loading the embedded calendar after your direct tab selection or explicit load action is based on your specific request and consent to display that third-party content under § 25 (1) TDDDG and Art. 6 (1)(a) GDPR. You can avoid this processing by not loading the calendar and contacting us by email instead. Once loaded, requests already sent to Cal.com cannot be withdrawn; you can stop further interaction by leaving or reloading the page.

If you make a booking, Cal.com processes the details you enter and makes the booking information available to us so that we can arrange and conduct the requested meeting. Our legal basis is Art. 6 (1)(b) GDPR where the meeting concerns pre-contractual or contractual steps, and Art. 6 (1)(f) GDPR for other requested business meetings. Cal.com states that its services can involve processing in the United States. Review the provider's information before opening or using the booking service: cal.com/privacy.

5. Consent storage and Google Analytics

We store your cookie preference in your browser under the key klugspice-cookie-consent. It contains your necessary/analytics choice, the policy version, and timestamps for when the choice was made and when it expires. This storage is used only to remember and apply your requested preference. It expires after 180 days, after which we ask you to choose again. Access to this preference is strictly necessary to provide the privacy choice you requested and is based on § 25 (2) no. 2 TDDDG. To the extent the preference itself is personal data, our legal basis is our legitimate interest in recording and respecting that choice under Art. 6 (1)(f) GDPR.

Google Analytics is disabled by default. It is loaded only if you actively consent to optional analytics. Storage of or access to analytics identifiers is based on your consent under § 25 (1) TDDDG, and the related processing of personal data is based on Art. 6 (1)(a) GDPR. Analytics helps us understand pseudonymous website use. Data can include a pseudonymous browser identifier, visited pages, approximate location derived from an IP address, referrer, browser/device characteristics, interactions, and visit time. We do not enable Google advertising storage or advertising-personalisation features through this implementation.

Google Analytics is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When enabled, it can set _ga to distinguish browsers and a property-specific _ga_* cookie to maintain analytics state. We configure these cookies for a maximum lifetime of 12 months without extending their expiry on every visit; your browser may apply a shorter limit. Event-level information in the Analytics account is retained according to the property-level retention setting and is deleted when it is no longer required for website analysis. You may ask us for the account setting currently applied.

You can grant or withdraw analytics consent at any time through “Cookie Settings” in the footer. Withdrawal disables further analytics collection, removes accessible Google Analytics cookies, and does not affect the lawfulness of processing before withdrawal. Google's privacy information is available at policies.google.com/privacy.

6. Required and optional contact information

Name, email address, message, and acknowledgement that you have read this notice are required so that we can identify, understand, and answer an enquiry. If you do not provide them, the form cannot prepare the email draft. Company, job title, phone number, and industry are optional and help us route and contextualise your request. You can instead contact us directly by email and provide only the information needed for your question.

7. Service providers, recipients, and international processing

Personal data is disclosed only where necessary to providers supporting website delivery, analytics (after consent), booking (after you choose the booking service), and email delivery, or where disclosure is required by law. We do not sell personal data. We do not use this website for automated decision-making or profiling that produces legal or similarly significant effects.

AWS, Google, Cal.com, or an email provider can involve processing outside the European Economic Area, including in the United States. A transfer outside the EEA requires an applicable mechanism under Chapter V GDPR. Because the relevant recipient and mechanism can depend on the service and account configuration, you may contact us for information about the mechanism applicable to your data and how to obtain a copy or description of the relevant safeguards. We do not claim a particular transfer safeguard in this policy unless it has been verified for the applicable processing arrangement.

8. The KlugSpice platform

This public website is separate from customer deployments of the KlugSpice engineering platform. Customer deployment and data-governance terms are defined in the applicable customer agreement and technical configuration. This website privacy policy does not replace those terms.

9. Your rights

Subject to the applicable legal requirements, you have the right to:

• access your personal data (Art. 15 GDPR);
• rectification of inaccurate data (Art. 16 GDPR);
• erasure (Art. 17 GDPR);
• restriction of processing (Art. 18 GDPR);
• data portability (Art. 20 GDPR);
• object to processing based on legitimate interests (Art. 21 GDPR); and
• withdraw consent at any time with effect for the future (Art. 7 (3) GDPR).

To exercise any of these rights, contact us at info@klugsys.com. You also have the right to lodge a complaint with a supervisory authority. The competent authority for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW).

10. Questions and policy changes

For questions about this policy or our processing of personal data, email info@klugsys.com. We update this notice when our processing or legal obligations change. The effective date and version at the top identify the current revision.