Privacy Policy

The controller responsible for the processing of your personal data is:

Kuro Studio
Hirschberger Str. 24, 90559 Burgthann, Germany
Represented by: Lukas Wirth
Email: legal@kurostudio.io
Phone: +49 157 57151022

We process your personal data in accordance with the EU General Data Protection Regulation (GDPR) and the applicable national data protection law. For every processing described below we name its purpose and legal basis.

When you open this website, your browser automatically sends technical data to our hosting provider: IP address, date and time of the request, requested page, referrer URL, browser type and version, operating system and device information.

Purpose: delivering the website, ensuring its stability and security, and detecting and defending against attacks.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in a secure and functioning website.

Retention: server logs are kept by the hosting provider for a limited period (at most 30 days) and then deleted, unless an incident requires longer retention to clarify it.

We do not combine this data with other data sources.

We use cookies and comparable technologies (local storage, session storage) only as far as they are strictly necessary to provide this website, or with your consent.

Strictly necessary storage (for example your cookie choice or a login session) is based on § 25(2) of the German TDDDG and comparable national rules implementing Art. 5(3) of the ePrivacy Directive, and on Art. 6(1)(f) GDPR.

Functional, analytics and marketing technologies are only loaded after you have given your consent in our cookie banner (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). Until then, these scripts are not loaded at all. You can change or withdraw your choice at any time via "Cookie settings" at the bottom of every page; a withdrawal takes effect for the future.

The following technologies can be used on this website:

With your consent we use analytics and advertising services to understand how our website is used and to measure and optimise our advertising campaigns. The services used are listed in the table above and under "Recipients and service providers".

Data processed: pseudonymous online identifiers, IP address (shortened where the service supports it), device and browser information, pages visited, interactions (for example submitting a form, without its content), referrer and campaign parameters such as the advertising click ID.

Google Analytics and Google Ads: Google Consent Mode passes your choice on to Google: analytics storage is only granted with analytics consent, advertising storage and ad personalisation only with marketing consent.

Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw it at any time with effect for the future via "Cookie settings".

Retention: see the storage periods in the table above; data stored by the providers is kept according to their policies.

Our forms are protected by Cloudflare Turnstile. When a form is loaded, Turnstile checks technical signals of your browser (for example IP address, browser characteristics and interaction signals) to distinguish people from automated programs. Turnstile does not use advertising cookies and does not show image puzzles.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our forms, systems and staff against spam, fraud and automated abuse. As this check is necessary to send the form you request, it is not subject to consent.

If you contact us via a contact form, email, phone or a messenger, we process the details you provide: name, email address, phone number, your message and, where you provide them, further details about your request. We also store the date and source of your request and a record that you asked us to contact you.

Purpose: answering your request and, where relevant, preparing and performing a contract.

Legal basis: Art. 6(1)(b) GDPR where your request aims at concluding or performing a contract; otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering requests addressed to us.

Retention: we keep your request as long as it is needed to handle it and any resulting business relationship. We then delete it, unless statutory retention obligations (for example commercial and tax law) require us to keep it longer.

If you subscribe to our newsletter, we process your email address and, if provided, your name and language. After you sign up, we send you an email asking you to confirm your subscription (double opt-in). We only send newsletters after this confirmation and store the time of sign-up and confirmation as proof of your consent.

Legal basis: Art. 6(1)(a) GDPR.

Withdrawal: you can unsubscribe at any time via the link in every newsletter or by writing to us. We then stop sending newsletters and keep only a record of your consent and its withdrawal, so that we can prove it and do not send you newsletters again (Art. 6(1)(c) and (f) GDPR).

If you submit a lead form in one of our advertisements on Facebook, Instagram or Google, the platform passes the details you entered (usually name, email address, phone number and your answers) to us together with information about the campaign and form. The platform processes this data as its own controller; the form tells you what is shared with us.

Purpose and legal basis: answering your request and contacting you about it, Art. 6(1)(b) GDPR. Where the form asks for consent to marketing communication, we rely on that consent (Art. 6(1)(a) GDPR) for the channel you provided.

Retention: as described under "Contact requests".

When we communicate with you by email, phone or WhatsApp, we process your contact details and the content of the communication to handle your matter. Emails are processed by our email provider; WhatsApp messages are transmitted via Meta's WhatsApp Business platform. If you use WhatsApp, WhatsApp itself also processes your data as its own controller under its terms.

Our staff receive internal notifications about new requests (by email and, where configured, by WhatsApp) so that we can respond quickly. These notifications contain only the details needed to process the request.

Legal basis: Art. 6(1)(b) GDPR where the communication concerns a contract or pre-contractual steps; otherwise Art. 6(1)(f) GDPR.

If you commission us or are a contact person of a customer or business partner, we process your contact details, contract and project data, correspondence, and invoicing and payment data.

Purpose: preparing and performing the contract, invoicing and accounting.

Legal basis: Art. 6(1)(b) GDPR; for accounting and statutory retention Art. 6(1)(c) GDPR; for communication with contact persons of companies Art. 6(1)(f) GDPR.

Retention: for the duration of the contract; invoices and accounting records for the statutory periods (in Germany up to ten years under § 147 AO and § 257 HGB).

After a completed project we may invite customers to rate us on Trustpilot. For this we pass your name, email address and an order reference to Trustpilot, which sends you the invitation. Whether you leave a review is up to you.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in collecting genuine customer feedback. You can object at any time; we will then not send you any invitations.

To be able to prove consents you have given or withdrawn, we record for consents given in forms the wording of the notice or checkbox you confirmed, the time and the language.

For your cookie choices we record the decision, the categories concerned, the time, the page and language, the browser used and a shortened IP address.

Legal basis: Art. 6(1)(c) in conjunction with Art. 7(1) GDPR.

Retention: as long as we need to be able to prove the consent, that is for as long as the consent is used plus the limitation period for possible claims.

We only pass on your data where this is necessary for the purposes described above. Service providers who process data on our behalf are bound by data processing agreements (Art. 28 GDPR). Advertising and social platforms that you use are their own controllers.

In addition, data may be passed to public authorities, courts or advisers bound to professional secrecy (for example lawyers, tax advisers, auditors) where we are legally obliged to do so or where it is necessary to establish, exercise or defend legal claims.

We use the following service providers:

Some of the service providers listed above are located outside the EU/EEA, in particular in the USA, or can access data from there. We only transfer data to such countries if the requirements of Art. 44 et seq. GDPR are met: an adequacy decision of the European Commission (for example the EU-US Data Privacy Framework for certified US companies), EU Standard Contractual Clauses, or, for specific cases, your explicit consent (Art. 49(1)(a) GDPR). The table above names the safeguard for each provider. You can request a copy of the safeguards from us.

Unless a more specific period is stated above, we delete or anonymise personal data as soon as it is no longer needed for the purpose for which it was collected, you have withdrawn your consent and there is no other legal basis, or you have successfully objected. Statutory retention obligations (for example commercial, tax or anti-money-laundering law) can require us to keep certain data longer; during this period it is restricted to that purpose.

Deleted data can remain in backups of our systems until these backups are deleted according to our backup schedule. It is not restored or used for any other purpose in the meantime.

You have the following rights regarding your personal data:

• Access to the data we hold about you and information about its processing (Art. 15 GDPR)
• Rectification of inaccurate or incomplete data (Art. 16 GDPR)
• Erasure of your data, unless we are legally obliged to keep it (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability: receiving the data you provided in a structured, commonly used, machine-readable format (Art. 20 GDPR)
• Withdrawal of consent at any time with effect for the future (Art. 7(3) GDPR); the lawfulness of processing before the withdrawal remains unaffected

Right to object (Art. 21 GDPR): where we process your data on the basis of legitimate interests, you can object at any time for reasons arising from your particular situation. You can object to the use of your data for direct marketing at any time without giving reasons; we will then no longer use it for this purpose.

To exercise your rights, write to legal@kurostudio.io. We may ask you to verify your identity. We respond without undue delay and at the latest within one month; the PDPL and GDPR allow this period to be extended in complex cases, in which case we inform you.

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR).

The authority responsible for us is Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

You are not obliged to provide personal data. Without the details marked as required in a form, however, we cannot handle the corresponding request (for example answer your inquiry or process your application). Technical data when visiting the website is required to deliver it.

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).

We protect your data with technical and organisational measures appropriate to the risk, including encrypted transmission (TLS), access controls based on roles and permissions, private file storage with short-lived access links, logging of access, regular backups and the careful selection and supervision of our service providers.

We update this privacy policy when our processing or the legal situation changes. The current version and its effective date are shown at the top of this page.

For all questions about data protection and to exercise your rights, contact us at legal@kurostudio.io or by post at Kuro Studio, Hirschberger Str. 24, 90559 Burgthann, Germany.