Start a Project

Privacy Policy

Last updated:

This policy explains what happens to your data when you use kuestenkurs.com. It describes what this site actually does, which is less than most sites: it sets no cookies for visitors, loads nothing from a third party, and runs no analytics.

1. Who is responsible

Kempt Road Consulting Inc.
P.O. Box 1, Cleveland, NS B0E 1J0, Canada
Email: info@kuestenkurs.com
Telephone: +1 (902) 623-2194

We have not appointed a data protection officer. We are not required to. Questions about your data go to the address above and reach a person, not a queue.

2. Which law applies

We are a Canadian company and we offer services to people in Germany and the wider EU. Two regimes therefore apply at once:

  • the GDPR, because we offer services to people in the European Union (Art. 3(2)(a) GDPR); and
  • PIPEDA, Canada's federal private-sector privacy law, for our operations in Canada.

Where the two differ, we apply whichever gives you more protection.

3. Where your data is stored

This website runs on a server operated by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. The server is physically located in Frankfurt am Main, Germany. Our mailboxes are also hosted by Hostinger. A data processing agreement is in place.

Everything this site stores — enquiries, orders, subscriptions — is held in a database on that server in Germany. It is not copied to Canada as part of the website's normal operation. When we reply to you, that correspondence is naturally read by us in Canada.

4. What we collect, and why

4.1 Server log files

Like any web server, ours records each request: the page requested, the date and time, the amount of data transferred, your browser and operating system, the referring page and your IP address. This is technically necessary to deliver the site and to recognise attacks.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in a functioning, secure website. Retention: log entries are kept for a maximum of 14 days and then overwritten. They are not combined with any other data and are not used to identify you.

4.2 Contact form

If you use the contact form we receive your name, your email address, your message and — if you enter one — your telephone number. We also store the time, your IP address and your browser identification, because that is what lets us demonstrate later that a message was actually sent by someone.

Legal basis: Art. 6(1)(b) GDPR where your message concerns a possible contract, otherwise Art. 6(1)(f) GDPR — our legitimate interest in answering enquiries. Retention: six months after the enquiry is closed, unless it turns into a project, in which case commercial retention periods apply.

4.3 Service enquiries and orders

The order form on each service page asks for your name, email address, telephone number and what you need. Submitting it does not conclude a contract; it starts a conversation. A client record is created from what you send so we do not have to ask you the same questions twice.

Legal basis: Art. 6(1)(b) GDPR, steps taken at your request before entering into a contract. Retention: for the duration of the working relationship, then as required by commercial and tax law.

4.4 Newsletter

The newsletter uses double opt-in. You enter your address; we send one email with a confirmation link; nothing else is sent unless you click it. We store your address, your language, the time of the request, the time of confirmation, and the IP address used for each — that is the evidence of consent the law requires us to be able to produce.

The confirmation and unsubscribe links are stored only as a hash. Reading our database does not give anyone a usable link to your subscription.

Legal basis: Art. 6(1)(a) GDPR, your consent. Withdrawal: every mailing carries an unsubscribe link, and you can write to us at any time. Withdrawing does not affect the lawfulness of what happened before. Retention: until you unsubscribe; the record of the unsubscription is kept so we do not contact you again by mistake.

4.5 Consent record

If the cookie banner is shown to you and you make a choice, we store that choice, the version of this policy it applied to, the time, and a shortened IP address — the last block is removed, so an individual cannot be identified from it. This exists so that we can show a consent was given, which is itself a legal requirement.

Legal basis: Art. 7(1) GDPR, the duty to be able to demonstrate consent.

5. Cookies and local storage

This site sets no cookies at all for ordinary visitors. There is no tracking cookie, no analytics cookie and no advertising cookie, because there is no analytics and no advertising.

Two small exceptions, neither of which identifies you:

  • If you switch to dark mode, your browser remembers that choice in local storage under the key keystone-theme. It never leaves your device and is never sent to us.
  • If you sign in to the administration area — which only we can do — a session cookie is set. It is strictly necessary and expires.

6. Fonts, maps, videos and social media

All fonts are served from our own server. Nothing is requested from Google Fonts, so your IP address is not transmitted to Google when you open a page.

There are no embedded maps, no embedded videos and no social media widgets. The WhatsApp, Telegram and LinkedIn buttons are ordinary links: nothing is loaded from those services until you click, and clicking takes you to them, where their own privacy policies apply.

7. Analytics and advertising

We use none. No Google Analytics, no Meta pixel, no heatmaps, no A/B testing tool, no remarketing. If that ever changes, we will ask for your consent first and update this policy before switching anything on.

8. Who else sees your data

We do not sell data and we do not share it for advertising. Your data is disclosed only to:

  • Hostinger International Ltd. (Cyprus; servers in Germany) — hosting and email, as our processor;
  • professional advisers — our accountant and, where necessary, a lawyer — bound by professional confidentiality;
  • public authorities, where we are legally obliged to disclose.

Client access credentials, where a client asks us to hold them, are stored encrypted and every time one is decrypted the access is logged with the account that asked for it.

9. Your rights

Under the GDPR you have the right to:

  • access the data we hold about you (Art. 15);
  • have inaccurate data corrected (Art. 16);
  • have data erased (Art. 17);
  • restrict processing (Art. 18);
  • receive your data in a portable format (Art. 20);
  • object to processing based on legitimate interest (Art. 21);
  • withdraw consent at any time, with effect for the future (Art. 7(3)).

Write to info@kuestenkurs.com. We answer within one month. Under PIPEDA you have equivalent rights of access and correction, and may complain to the Office of the Privacy Commissioner of Canada.

10. Complaints

You may complain to a supervisory authority — in Germany, the data protection authority of the federal state where you live, work, or where you believe the infringement occurred. In Canada: the Office of the Privacy Commissioner of Canada.

11. Is providing data required?

No. Browsing the site requires nothing from you. If you want a reply, we need an address to reply to; that is the only thing that is genuinely mandatory, and it is marked as such on the form.

12. Automated decisions

We do not use automated decision-making or profiling.

13. Changes

If we change how we handle data, we update this page and the date shown at the top of it. Material changes affecting a consent you have given will be brought to your attention rather than published quietly.