Privacy Policy
This policy explains which personal data we process when you visit this website, for what purposes, and what rights you have.
This English version is provided for convenience. In the event of any discrepancy, the German version shall prevail.
Summary
- We do not use analytics or marketing cookies and do not create user profiles.
- The website is delivered via Cloudflare. This involves processing technically necessary connection data such as your IP address.
- Enquiries sent via our forms reach us by email. We use the Resend service to send them.
- We only load fonts from Google Fonts if you consent.
- Among other things, you have the right to access, rectification and erasure. You can withdraw your consent at any time.
Controller
The controller responsible for data processing on this website is:
KP GmbH
Pillenreuther Straße 14
90459 Nuremberg
Germany
Represented by its managing director, Steffen Näther
Email: [email protected]
Legal bases
We only process personal data where a legal basis permits us to do so. The relevant legal bases are in particular:
- Art. 6(1)(a) GDPR: your consent,
- Art. 6(1)(b) GDPR: the performance of a contract or pre-contractual measures, for example when handling a financing enquiry,
- Art. 6(1)(c) GDPR: compliance with legal obligations, for example statutory retention obligations,
- Art. 6(1)(f) GDPR: our legitimate interests, for example in operating the website securely and reliably.
In addition, Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) applies to storing information on your device and accessing it. Without consent, this is only permitted where it is strictly necessary to provide a service you have expressly requested (Section 25(2) no. 2 TDDDG). In all other cases, we ask for your consent (Section 25(1) TDDDG).
Hosting and server log files
This website is provided via the Cloudflare platform (Cloudflare Pages), a service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare delivers the pages via a global server network and protects the website against attacks and overload.
Each time the website is accessed, Cloudflare processes technically necessary connection data, in particular your IP address, the date and time of access, the address requested, the previously visited page (referrer) and information about your browser and operating system. The website cannot be delivered without this data. The legal basis is our legitimate interest in providing the website securely, quickly and reliably (Art. 6(1)(f) GDPR). We do not analyse this data ourselves or combine it with other data.
To protect against automated attacks, Cloudflare may set technically necessary security cookies, for example “__cf_bm” when bot protection is active (lifetime 30 minutes). They serve exclusively to keep the website secure (Section 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR).
Cloudflare processes the data on our behalf under a data processing agreement (Art. 28 GDPR). Data may be transferred to the United States in the process. Cloudflare states that it is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); EU Standard Contractual Clauses also apply (Art. 46(2)(c) GDPR). Further information is available in Cloudflare’s privacy policy.
We do not use analytics or marketing cookies. Services that require consent are only loaded after you have agreed in the privacy banner. Consent management is part of this website; no data is shared with third parties for this purpose. You can withdraw your consent at any time with effect for the future, via “Privacy settings” in the footer or the button above.
Google Fonts (only with consent)
To ensure a consistent appearance, the fonts of this website can be loaded from Google Fonts, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This only happens if you consent in the privacy banner. Without consent, the website uses your system’s fonts.
When the font files are loaded, your IP address and technical browser data are transmitted to Google. No cookies are set in the process. A transfer to Google LLC in the United States cannot be ruled out; Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time. Further information is available in Google’s privacy policy.
Contacting us via forms and email
Contact forms: You can contact us via the enquiry wizard on the Contact page or via the quick enquiry (“Financing enquiry” button). We process the information you enter: first name, last name and business email address and, optionally, phone number, company, type of enquiry, capital requirement, timing, intended use and your description. We also receive the language of the form and the page from which you sent your enquiry.
Email: If you send us an email, we process your email address, your name and the content of your message.
Purpose and legal basis: We use this information solely to handle your request and to get in touch with you. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to entering into a contract or to pre-contractual measures, and otherwise our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR).
Protection against misuse: To detect automated spam, we check a form field that is invisible to people and the time between opening and submitting the form when you submit it. No cookies are set and no information is stored on your device for this purpose.
Delivery by email via Resend: When you submit the form, your enquiry is transmitted in encrypted form to our website and automatically forwarded as an email to our mailbox. We use the Resend service of Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA, to send this email. Resend processes the data on our behalf under a data processing agreement (Art. 28 GDPR). The data is processed and stored in the United States. The transfer is based on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR); in addition, Resend states that it is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Resend currently retains sending data for 30 days. Further information is available in Resend’s privacy policy.
Recipients and transfers to third countries
We only share personal data where this is necessary for the purposes described, where you have consented, or where we are legally obliged to do so. We do not sell data. The following service providers process data on our behalf (Art. 28 GDPR):
- Cloudflare, Inc., USA: hosting and delivery of the website, protection against attacks
- Plus Five Five, Inc. (Resend), USA: sending form enquiries by email
With your consent, Google (Google Ireland Limited, Ireland) also receives your IP address when Google Fonts are loaded.
Where data is transferred to the United States, the transfer is based on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), insofar as the recipient is certified, and additionally on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
Retention
We only store personal data for as long as is necessary for the respective purpose. We delete enquiries once they have been fully handled, unless statutory retention obligations, in particular under commercial and tax law, require otherwise. In that case, we restrict processing and delete the data once the retention period has expired. For how long settings remain stored in your browser, see the section “Cookies, local storage and external services”.
Your rights
You have the following rights with regard to your personal data:
- access (Art. 15 GDPR),
- rectification (Art. 16 GDPR),
- erasure (Art. 17 GDPR),
- restriction of processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR),
- withdrawal of consent with effect for the future (Art. 7(3) GDPR).
Right to object (Art. 21 GDPR): Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
To exercise your rights, simply send an email to [email protected].
Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR). The authority responsible for us is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Germany
www.lda.bayern.de
Further information
Obligation to provide data: You are under no statutory or contractual obligation to provide us with personal data. However, we cannot handle an enquiry without the information marked as required.
No automated decision-making: We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.
Data security: This website uses TLS encryption, recognisable by “https://” in your browser’s address bar. This means that data you send to us cannot be read by third parties. We also take technical and organisational measures to protect your data against loss, manipulation and unauthorised access.
Last updated
November 2026. We update this privacy policy when the website, the services we use or the legal requirements change.