Privacy Policy

1. Privacy at a glance

General notes

The following notes give a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally.

2. Controller

The controller responsible for data processing on this website is:

3. Data collection on this website

Contact form

If you send us enquiries via the contact form, your details from the enquiry form, including the contact data you provide there, will be stored by us for the purpose of processing the enquiry and in the event of follow-up questions. We do not pass on this data without your consent. The processing of this data is based on Art. 6 para. 1 lit. b GDPR, insofar as your enquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures.

4. Your rights

You have the right at any time to request free information about the origin, recipient and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given your consent to data processing, you can revoke this consent at any time for the future. You also have the right to request the restriction of the processing of your personal data under certain circumstances.

To exercise your rights, please contact: hallo@kimatix.koeln

5. Hosting

This website is hosted externally. The personal data collected on this website is stored on the host's servers. This may include IP addresses, contact requests, meta and communication data, contract data, contact details, names, website access data and other data generated via a website.

6. Payment service provider – GoCardless

For payment processing we use the service GoCardless. The provider is GoCardless Ltd., Sutton Yard, 65 Goswell Road, London EC1V 7EN, United Kingdom.

What data is transmitted?

The following personal data is transmitted to GoCardless during payment processing:

• First and last name
• Email address
• Billing address
• Bank details (IBAN, BIC)
• Payment amount and currency
• Transaction and mandate reference

Purpose and legal basis

The data transfer serves exclusively for processing payments via direct debit or Open Banking. The legal basis is Art. 6 para. 1 lit. b GDPR (contract performance). GoCardless acts as a data processor pursuant to Art. 28 GDPR; a corresponding data processing agreement has been concluded.

Third-country transfer

GoCardless is based in the United Kingdom. The European Commission has issued an adequacy decision for the United Kingdom pursuant to Art. 45 GDPR, meaning that data transfers are permitted without additional safeguards.

Further information on data protection at GoCardless can be found at: gocardless.com/de-de/datenschutz/

7. Payment service provider – Stripe

For payment processing we use the service Stripe. The European provider is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. The parent company is Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, USA.

What data is transmitted?

The following personal data is transmitted to Stripe during payment processing:

• First and last name
• Email address
• Billing address
• Payment data (truncated card number, expiry date, card type)
• Payment amount and currency
• IP address and device information (fraud prevention)
• Transaction ID

Purpose and legal basis

The data transfer serves to process credit card, debit card and other electronic payments. The legal basis is Art. 6 para. 1 lit. b GDPR (contract performance). Stripe acts as a data processor pursuant to Art. 28 GDPR; a corresponding data processing agreement has been concluded.

Third-country transfer

Stripe Payments Europe, Limited processes data within the EU/EEA. Transfers to the US parent company Stripe, Inc. are based on Standard Contractual Clauses (SCCs) pursuant to Art. 46 para. 2 lit. c GDPR, which ensure an adequate level of data protection.

Further information on data protection at Stripe can be found at: stripe.com/de/privacy