Privacy policy

1. Controller

The controller responsible for processing personal data on this website is:

Junaid Akhter, Kasiski Labs
Arnikaweg 25, 33100 Paderborn, Germany
Phone: +49 1525 9640329, Email: contact@kasiski.org

No data protection officer has been appointed, as the legal requirements for one are not met.

2. Principles

We process personal data only where this is necessary to run this website and to respond to your enquiries. This website uses no cookies, no analytics or tracking tools and no contact form, and embeds no third-party content. Fonts are loaded locally from our own server.

3. Hosting and server log files

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA ("Vercel"). Vercel delivers the website through a worldwide server network (content delivery network); requests are usually answered by a server near you. Each time the website is accessed, Vercel automatically processes the following data in server log files: IP address, date and time of access, page or file requested, referrer URL, browser and operating system, amount of data transferred and status code.

This processing serves to deliver the website, to keep it stable and secure, and to analyse errors. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and error-free operation of the website. Log files are deleted after 1 day, unless they are needed for longer to investigate a specific security incident.

Data may be transferred to the USA in this process. Vercel is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR). We have concluded a data processing agreement with Vercel in accordance with Art. 28 GDPR.

4. Encryption

For security reasons, this website uses TLS encryption. You can recognise an encrypted connection by "https://" in your browser's address bar.

5. Contacting us by email or phone

If you contact us by email or phone, we process the data you provide (such as name, email address, phone number, organisation and the content of your message) in order to handle your enquiry.

The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to entering into or performing a contract, and otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in responding to enquiries addressed to us.

We delete your data once your enquiry has been fully dealt with and no further communication is expected. Data subject to statutory retention obligations (in particular under Section 147 of the German Fiscal Code and Section 257 of the German Commercial Code) is kept for the duration of those periods.

Emails are processed by Hostinger International Limited, 61 Lordou Vironos str., 6023 Larnaca, Cyprus. We have concluded a data processing agreement with Hostinger in accordance with Art. 28 GDPR. Hostinger uses service providers that may process data outside the EU, including in the USA (for example Cloudflare, Inc. for incoming mail). Such transfers are based on the EU standard contractual clauses in Hostinger's data processing agreement (Art. 46(2)(c) GDPR).

6. Contacting us via WhatsApp

This website contains a link you can use to contact us via WhatsApp. Only when you click the link are you redirected to WhatsApp; no data is transmitted to WhatsApp before that. WhatsApp is a service of WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Data may be transferred to Meta Platforms, Inc. in the USA. Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission exists.

If you contact us via WhatsApp, we process your phone number, profile name and the content of your messages to handle your enquiry. The legal basis is Art. 6(1)(b) or (f) GDPR. Using WhatsApp is voluntary; you can always reach us by email or phone instead. Please do not send us confidential information via WhatsApp. For more information, see WhatsApp's privacy policy: https://www.whatsapp.com/legal/privacy-policy-eea

7. Recipients and transfers to third countries

Your data is received only by the service providers named above (Vercel, Hostinger and, if you contact us that way, WhatsApp). Vercel and Hostinger act on our behalf and on our instructions. Transfers to the USA take place on the basis of the adequacy decision for the EU-US Data Privacy Framework (Vercel, WhatsApp) or the EU standard contractual clauses (Hostinger's service providers). Any further disclosure takes place only where we are legally obliged to do so or where it is necessary to perform a contract with you. We do not sell personal data.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). To exercise your rights, an informal message to contact@kasiski.org is sufficient.

Right to object under Art. 21 GDPR: Where we process your data on the basis of Art. 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation. We will then stop processing your data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

9. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

10. Provision of data and automated decisions

You are under no legal or contractual obligation to provide us with personal data. Without your contact details, however, we cannot respond to your enquiry. No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

11. Updates

We update this privacy policy when our website or the legal requirements change. In case of doubt, the German version prevails.