Privacy policy

This is a courtesy translation. Only the German version is legally binding; in the event of any discrepancy, the German wording prevails.

Note: the services, processors and retention periods described here reflect how this website actually operates. A final legal review of this privacy policy is still pending.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

K2 Vertex GmbH
Eilder Dyk 53
47647 Kerken
Germany
Phone: +49 170 926 5693
Email: info@k2-vertex.de

2. General information on data processing

As a matter of principle, we process our users’ personal data only to the extent necessary to provide a functioning website along with our content and services. Processing regularly takes place either on the basis of consent (Art. 6(1)(a) GDPR) or on one of the other legal bases set out in Art. 6(1) GDPR.

3. Hosting

This website is provided via AWS Amplify Hosting. Technically necessary access data (server logs) are processed in doing so. The legal basis is our legitimate interest in operating the website securely and efficiently (Art. 6(1)(f) GDPR).

The processor is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. A data processing agreement pursuant to Art. 28 GDPR is in place.

Server location and delivery. The application itself runs in the AWS region eu-central-1 (Frankfurt am Main, Germany). Delivery to your browser, however, takes place via the global content delivery network Amazon CloudFront, which AWS Amplify Hosting places in front of every application. Your request is therefore normally served from whichever location is closest to you in network terms; for access from Germany that is a location within the EU. Processing outside the EU — in particular by Amazon Web Services, Inc. in the USA — cannot be ruled out. This is based on the European Commission’s standard contractual clauses as part of the AWS data processing agreement; in addition, Amazon Web Services, Inc. is certified under the EU-US Data Privacy Framework.

4. Access data / server log files

When you visit the website, AWS Amplify Hosting automatically records information transmitted by your browser. What is logged is essentially the IP address, the date and time of the request, the address requested, the HTTP status code, the volume of data transferred, the referring page, and browser and operating system identification (user agent). These data serve solely to operate the site securely and to diagnose faults; they are neither combined with other data sources nor evaluated for analytics purposes. The legal basis is Art. 6(1)(f) GDPR.

Retention. AWS Amplify Hosting does not offer a configurable deletion period for these access logs: according to AWS documentation they are retained for the lifetime of the application and removed when it is deleted. We are therefore unable to shorten that period ourselves. We retrieve the logs only when there is a specific reason to — for instance to resolve a fault or investigate a security incident — and do not evaluate them beyond that.

5. Contacting us via the contact form

If you contact us using the contact form, we process the details you enter solely in order to handle your enquiry. The following are collected: first and last name, email address, your message and — each of them optional — your company and the topic of your enquiry.

The legal basis is Art. 6(1)(b) GDPR (steps taken prior to entering into a contract) or Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries). Submission requires your express confirmation in the form.

How it works technically. The form transmits your entries to an interface at api.k2-vertex.de, operated in K2 Vertex GmbH’s AWS account in the eu-central-1 region (Frankfurt am Main, Germany). From there your enquiry is delivered to our mailbox as an email via Amazon Simple Email Service (SES). The processor in this respect is Amazon Web Services EMEA SARL.

Logging. For operational purposes and to prevent abuse, technical access data (time, IP address, status code) are logged for 30 days and then deleted automatically. The contents of your message are not logged.

Mailbox. Our email mailbox is operated via Google Workspace (Google Ireland Limited). Your enquiry is stored there until it is no longer required for the purpose and no statutory retention obligations stand in the way.

You may alternatively contact us directly by email or telephone at any time; the same principles then apply.

6. Audience measurement with Google Analytics

We use Google Analytics 4 (measurement ID G-SNTCC3LP3X) on this website, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The purpose is the statistical evaluation of website usage in order to improve the content and structure of the site.

Only with your consent. Google Analytics is loaded only after you have expressly agreed in the cookie notice. Without your consent, no Google script is loaded, no analytics cookies are set and no data is transmitted to Google. The legal basis is your consent under Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG.

Data processed. Where consent has been given, Google processes, among other things, a pseudonymous user identifier, the pages visited, the time and duration of the visit, the referring page, details of your browser and device, and a coarse location indication (as a rule country and region). Google Analytics 4 truncates IP addresses and does not store them permanently.

Cookies. The cookies set are _ga and _ga_<container ID>, each with a lifetime of up to two years. If you withdraw your consent, we delete these cookies immediately.

Transfer to a third country. Processing by Google LLC in the USA cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework; in addition, the European Commission’s standard contractual clauses are in place.

Withdrawal. You may withdraw your consent at any time with effect for the future, via the “Cookie settings” item in the footer of every page. Google additionally offers a browser add-on for opting out: tools.google.com/dlpage/gaoptout.

We store your decision on the cookie notice under the key k2:consent in your browser’s local storage, so that we do not have to ask you again on every page view. The entry contains only the value “granted” or “denied”, remains on your device and is not transmitted to us. The legal basis is § 25(2) no. 2 TDDDG, since storing it is strictly necessary in order to give effect to your choice. You can delete the entry at any time via your browser’s website data settings.

8. Your rights

You have the right of access (Art. 15 GDPR), to rectification (Art. 16 GDPR), to erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR), to data portability (Art. 20 GDPR) and to object (Art. 21 GDPR). You may withdraw consent once given at any time, and you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

9. Changes to this privacy policy

We update this privacy policy whenever changes to our data processing or to the legal situation make it necessary.

Last updated: 19 August 2026