Privacy Policy

Table of Contents

1. Controller and Contact
2. Principles
3. Visiting the Website
4. Enquiry and Appointment
5. Consultation
6. Order and Invoicing
7. Online Advertising (Meta)
8. Internal Processes
9. Recipients and Third Countries
10. Storage Period and Deletion
11. Your Rights and Complaints
12. Changes to This Privacy Policy

1. Controller and Contact

The controller responsible for processing your data is:

Rusi Kolev
Kolev Architektenküchen
Hauptstr. 39
61239 Ober-Mörlen

For all questions, including questions about data protection, you can reach us via our contact form. You will find our phone number and email address in our imprint.

2. Principles

In German, we address you with the informal “du”, as in all our communication. This does not affect your rights.

For advice and an offer, we need your contact details and information about your project. You are not obliged to provide them, but without them we cannot advise you. Every consent we ask you for is voluntary, and everything else works the same without it.

Cookie-Free Website

This website sets no cookies. Only if Cloudflare checks requests more closely during an attack on our website does it set a security cookie afterwards (Section 3.2). For the website analysis (Section 3.3) and the ad measurement (Section 7), we use no device fingerprinting. We do not embed advertising or analytics services of other providers, and without your consent we do not link page views to any person.

In your browser, we store only what is technically necessary: for the current session, whether you have dismissed a notice and the access to your client portal while it is open, and permanently only your wish to be excluded from the website analysis (Section 3.3). The legal basis is Section 25(2) no. 2 TDDDG. This is why there is no cookie banner. Click IDs (such as fbclid) and campaign codes (such as utm_source) that come with a link are not stored in your browser. Our website analysis counts the campaign code, but not the click ID. We store both with your enquiry only when you submit the questionnaire (Section 4.1).

3. Visiting the Website

3.1 Server and Encryption

Our website and the services we operate ourselves, such as the video consultation and the client portal, run on our server at Netcup GmbH in Germany. The connection is encrypted with SSL/TLS, which you can recognise by “https://”, so that unauthorised persons cannot read what you send us. With every request, the server stores technical access data such as IP address, time, page and browser. We use it only for secure operation and delete it after 14 days at the latest. The legal basis is Art. 6(1)(f) GDPR (our interest in a reliable and secure website).

3.2 CDN and DNS

So that our website is delivered quickly and securely, all requests, including forms and the client portal, pass through Cloudflare, Inc. (USA) as a content delivery network and DNS service. Cloudflare processes the data needed for this, such as IP address and requested address. IP addresses that stand out through attacks or misuse are blocked through Cloudflare for up to 30 days after the last incident. Only if Cloudflare checks requests more closely during an attack on our website does it, once the check has been passed, set a security cookie that contains no details about you and is valid for at most 30 minutes (Section 25(2) no. 2 TDDDG). Cloudflare Turnstile protects our contact form and the form for uploading photos and plans against automated entries. For this, a Cloudflare script checks technical characteristics of your browser and connection without reading what you type (Section 25(2) no. 2 TDDDG). Cloudflare also uses these characteristics under its own responsibility to improve its bot detection. The legal basis is Art. 6(1)(f) GDPR (our interest in a secure and fast website and in protection against spam).

3.3 Website Analysis

To see which content is read and how fast our pages load, we use self-hosted analytics software without cookies on our server in Germany. It records, for example, pages viewed (without personal links or click IDs), time spent, origin and campaign, device, browser, screen size and language, the country derived from the IP address, loading times and individual events. It also records the search terms typed into our FAQ search, so that we can add missing answers, as well as click positions and scroll depth, which we store without any link to your other page views and without the exact time. We do not record mouse movements, what you type or what is on your screen.

The analysis does not store your IP address. It counts page views using an identifier that changes every month and is formed from the IP address and browser identification, so the data is pseudonymous. Without your consent, we do not link it to any person and only evaluate it in aggregate (for consent when booking, see Section 4.4). The legal basis is Art. 6(1)(f) GDPR (our interest in an understandable and fast website). We keep the data for 24 months so that we can compare developments over the year. If you do not want to be counted in a browser, open any page in it once with ?notrack=1 added. With ?notrack=0, we count you again.

4. Enquiry and Appointment

4.1 Kitchen Planning Questionnaire

To prepare your consultation, our self-hosted questionnaire asks for your name, email address, phone number, postcode and details of your kitchen project (Art. 6(1)(b) GDPR). From your project details, the questionnaire calculates a score that shows how well your plans fit what we offer. It decides whether we remind you of an appointment automatically or Rusi writes to you personally (Art. 6(1)(f) GDPR, our interest in answering every enquiry in a suitable way). If your link carries a click ID or campaign code, we store it with your enquiry so that we can see how you found us (Art. 6(1)(f) GDPR). The click ID goes to Meta only with your yes (Section 7). If you do not book an appointment within 30 days and do not otherwise get in touch, we delete your enquiry with all its details. If your project is outside our service area, we delete the enquiry after six months instead.

4.2 Contact Form

If you write to us via the contact form, we use your name, email address, phone number (optional) and message to reply to you (Art. 6(1)(b) GDPR). We delete your message and our reply after six months, unless it turns into a project (Section 10).

4.3 Appointment Booking

You book appointments via self-hosted booking software. To show free slots, we sync only the date, time and a booking reference with Google Calendar. Your name and contact details are not sent to Google. After booking, you receive a personal link through which you can send us photos and plans of your room. The legal basis is Art. 6(1)(b) GDPR, and the storage period is given in Section 10.

4.4 Consultation Preparation

Before the appointment, our system puts the details from the questionnaire and the booking, including the score from Section 4.1, on one sheet for Rusi, with no AI and no assessment of you as a person. The legal basis is Art. 6(1)(f) GDPR (a well-prepared consultation). We delete the sheet together with your enquiry or, if you place an order, 12 months after the final invoice has been paid.

Website visits only with your consent: If you tick “Gesprächsvorbereitung” (consultation preparation) when booking an appointment, Rusi sees before the consultation which pages you viewed on the same device, from at most 30 days before the booking until the consultation, and roughly for how long. Only he sees this list, with no AI and no assessment of you as a person, and we delete the data 30 days after our first consultation. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via our contact form.

4.5 Guide by Email (Double Opt-In)

You can request our guide (in German) to the costliest mistakes when buying a kitchen with your first name and email address. Only after you have confirmed via the link do we send you the guide and, over the following three weeks, four short emails with tips, each with an unsubscribe link (consent, Art. 6(1)(a) GDPR, Section 7(2) no. 2 UWG). If you later fill in the questionnaire, we can see whether you downloaded the guide, and the tips stop. We store the proof of your consent and any campaign source from the link under Art. 6(1)(f) GDPR, so that we can prove your consent and see which channels work. We delete unconfirmed sign-ups after 30 days and everything else three years after the last tip email or after you unsubscribe.

5. Consultation

5.1 Video Consultation

Our video consultations, including one-to-one calls, run on self-hosted software on our own server in Germany. We process picture, sound and your IP address for the connection, and we pass nothing on to third parties.

Recording only at your request: By default, we record neither the initial consultation nor any later consultation. We only start a recording if you explicitly ask for one and consent. It lets us capture the points we discussed as a summary and tasks on your project board in the client portal straight after the consultation. Only once the recording has ended do we convert it into text via the EU endpoint of Mistral AI and summarise it via AWS in the EU (Sections 5.2 and 5.3).

You can withdraw your consent at any time, even during the consultation. We will then stop the recording immediately and delete what has already been recorded. The consultation can also take place without a recording. The legal basis is Art. 6(1)(b) GDPR, and for the recording your consent (Art. 6(1)(a) GDPR). We delete the recording 7 days after the consultation.

5.2 Speech Processing

For the summary, the AI speech recognition of Mistral AI SAS (Paris, France) converts the audio track of a requested recording into text, without the video. The transcript only distinguishes the speakers, and nobody is identified by their voice. For our account, Mistral AI keeps neither the audio nor the transcript beyond the conversion and does not use the data for training. The legal basis is your consent to the recording (Art. 6(1)(a) GDPR), which also covers the conversion into text.

Transfer to third countries: The audio data is processed via Mistral AI’s EU endpoint. Insofar as Mistral AI uses sub-processors outside the EU for this, the data processing agreement only permits such a transfer to countries with an adequacy decision of the European Commission (Art. 45 GDPR) or on the basis of appropriate safeguards under Art. 46 GDPR, in particular EU Standard Contractual Clauses.

5.3 Use of AI

For consultation summaries and drafts of emails and offer texts, we use an AI language model at Amazon Web Services (AWS) in the EU. It receives your questionnaire answers and, if you asked for a recording, the transcript. The AI records what you said, such as style preferences and budgets you mentioned, but does not evaluate you, and AWS does not use any of it for training. We delete the transcript and the summary together with your enquiry or, if you place an order, 12 months after the final invoice has been paid.

Rusi personally checks everything the AI drafts for you before it is sent to you. In automatic reminder emails, only the salutation comes from the AI, derived from your first name. If Rusi corrects an AI draft, we store both versions with your project number for 12 months to improve future drafts. Rusi decides on offers, prices and your project himself, and no automated decision-making within the meaning of Art. 22 GDPR takes place. The legal basis is Art. 6(1)(f) GDPR (careful and prompt handling of your project).

6. Order and Invoicing

6.1 Client Portal

For your project, you get a personal client portal on our own server in Germany, with project progress, tasks and files such as mood boards and drafts. You open it via your personal link, without a user account. Visits to the portal appear in the server log like all page views (Section 3.1), which we delete after 14 days at the latest. This also applies to the appliance catalogue with your prices, which you open via a personal link from the portal. We delete the portal content together with your other project data (Section 10). The legal basis is Art. 6(1)(b) GDPR.

In addition, we note which cards, files and images in the portal are opened and when, so that Rusi can see whether documents such as an offer have reached you. For this we only use the requests the portal sends to our server anyway to show you this content, no reading time and no clicks on links. Only Rusi sees these notes, and no AI evaluates them. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). You can object at any time (section 11), and we then stop noting anything for your portal.

6.2 Offer, Order and Invoice

We create offers, order confirmations and invoices with name, address and invoice data using the accounting software of Haufe-Lexware GmbH & Co. KG in Germany. Payment is by bank transfer, without a payment service provider. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for the statutory retention obligations (HGB, AO, periods in Section 10). If an offer does not lead to an order, we keep it for 2 years so that we can build on it if you come back to us (Art. 6(1)(f) GDPR).

For the 3D measurement of your rooms and for natural stone worktops, the specialist companies we commission receive the details they need: name, site address, phone number, plans and dimensions. They work under their own responsibility. The legal basis is Art. 6(1)(b) GDPR.

6.3 Email Delivery

Via Amazon Web Services (AWS) in the EU, we send our emails about your enquiry and your project, such as reminders, summaries, offers and invoices, and, only with your consent, the guide emails. We store reports about emails that could not be delivered or were marked as spam for 12 months, so that we do not keep writing to such addresses. A block on an address stays only as long as it is needed. The legal basis is Art. 6(1)(b) GDPR, for the guide emails your consent (Section 4.5) and for the delivery reports Art. 6(1)(f) GDPR (reliable delivery).

6.4 3D View

For your project you may receive a link to a 3D view of your kitchen and leave comments there. We store the name, comment and time and show them to everyone who has the link. The legal basis is Art. 6(1)(b) GDPR, and for comments by other people Art. 6(1)(f) GDPR (coordinating your project). We note when the 3D view was opened in the same way as views in the client portal (Section 6.1).

When we delete your enquiry or your project data, we take the 3D view offline and delete the comments. We keep the model without your name and address and may show it publicly as an example of our work (Art. 6(1)(f) GDPR).

7. Online Advertising (Meta)

We may run ads on Facebook and Instagram, but none are running at the moment. If you come to us via Facebook or Instagram, for example via an ad, we ask you in the questionnaire whether we may tell Meta that your click led to an enquiry. Visitors who do not come via Facebook or Instagram are not asked. Nothing is pre-selected, and nothing goes to Meta without your yes.

With your yes, our server may tell Meta when you submit the questionnaire, book an appointment, receive an offer or place an order (then with the order value). In doing so, we send the click ID, your IP address and your browser identifier. Your contact details (email address, phone number, name, postcode, town) and your client number go to Meta only in hashed (pseudonymised) form. This lets us measure which ads work and improve how they are delivered. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via our contact form. We delete our own log of these reports after 30 days.

Joint controllership: We and Meta Platforms Ireland Limited are jointly responsible for this processing (Art. 26 GDPR). We are responsible for the lawful collection and transmission of the data, including your consent, and Meta for the infrastructure and the processing of the data it receives. You can find the agreement at https://www.facebook.com/legal/controller_addendum. You can exercise your rights against us and against Meta. For the transfer to the USA, see Section 9.

8. Internal Processes

8.1 Internal Notifications

So that we can react quickly, our system sends internal notices with your name, your contact details and details of the event to our work phone, for example when you submit the questionnaire, book an appointment or write in the client portal. We run the service for these notices on our own server in Germany, and no other provider is involved. We delete the notices from the server after 14 days at the latest and from the phone after one month. The copy in the internal log of your project board is deleted together with your project data. For every questionnaire, we also receive an email with your details in our mailbox, which we delete as soon as your enquiry has been deleted. The legal basis is Art. 6(1)(f) GDPR (prompt handling of your project).

8.2 Data Backup

So that nothing is lost, we store encrypted backup copies of our data at Hetzner Online GmbH in Germany. The legal basis is Art. 6(1)(f) GDPR (data security). The backups are overwritten on a rolling basis, and deleted data is no longer contained in them after three months at the latest.

8.3 Public Mentions

If you write about us publicly or link to our website, we find the post through Google Alerts, Reddit or Meta. We then store, for 12 months, the link to the post, the platform, the time we found it and the page of our website it links to. The legal basis is Art. 6(1)(f) GDPR (our interest in knowing where people talk about us and being able to reply).

9. Recipients and Third Countries

Sections 3 to 8 name who receives your data. These recipients are based outside the EU and the EEA or may process data there:

For Cloudflare and Meta, the Standard Contractual Clauses (SCCs, Art. 46(2)(c) GDPR) also apply in case the adequacy decision for the Data Privacy Framework ceases to apply, and for Google only the adequacy decision applies. You can obtain a copy of the Standard Contractual Clauses via our contact form. The text is also available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj, and the list of certified companies at https://www.dataprivacyframework.gov/list. Amazon Web Services belongs to a US group. Our contracting partner is Amazon Web Services EMEA SARL in Luxembourg, and processing takes place in data centres in the EU.

10. Storage Period and Deletion

We only store data for as long as the purpose or the law requires. Here are all periods at a glance:

If no order follows, we delete your enquiry with all its details, including any booking, after the periods in the table. The exception is an offer we sent you: we keep it for 2 years (Section 6.2). We keep an enquiry longer only while a matter with you is still open. We keep project data until the end of the warranty period so that we have all plans to hand if anything needs to be put right.

11. Your Rights and Complaints

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure unless a statutory retention obligation prevents it (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR). We do not carry out any automated decision-making within the meaning of Art. 22 GDPR. A short message via our contact form is all it takes.

Right to Object (Art. 21 GDPR)

Where processing is based on our legitimate interest (Art. 6(1)(f) GDPR), you can object to it at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or we need it to establish, exercise or defend legal claims. You can object to the use of your data for direct marketing at any time without giving reasons.

Right to Lodge a Complaint

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

The Hessian Commissioner for Data Protection and Freedom of Information (HBDI)
Gustav-Stresemann-Ring 1
65189 Wiesbaden
https://datenschutz.hessen.de

12. Changes to This Privacy Policy

We update this privacy policy when our services or the legal situation change.

As of November 2026