Privacy
1. Controller
KF Prime Gebäudereinigung, sole proprietorship, proprietor: Faryal Qayomi, Königsberger Ring 11, 36205 Sontra, Germany. Telephone: +49 160 1090734. Email: kfprimereinigung@web.de. Further provider information is available in the Legal Notice.
2. Website access, hosting and server logs
When you access this website, the web server processes technically necessary connection and log data. This may include your IP address, date and time of access, requested page or file, transferred data volume, HTTP status, referrer, and browser, device and operating-system information where technically transmitted. Processing is used to provide the website securely, reliably and without errors, to analyse faults, and to detect and prevent misuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and reliable operation of the website. Log data is retained only for as long as required for operation, security and fault analysis or as provided by the hosting provider’s settings.
3. Contact and quote requests
When you use the quote form, we process the information you enter in order to handle your inquiry and prepare an individual quotation. The current form processes in particular your name, telephone number or email address, postcode/town, type of premises, one or more selected cleaning services, approximate size, and an optional message. Required fields are marked accordingly. Selected cleaning services are validated server-side against the permitted values provided by the form. The public quote form currently does not accept file uploads.
4. Purpose and legal bases for inquiry handling
Where your inquiry is directed toward entering into or performing a contract, processing is based on Art. 6(1)(b) GDPR. Other business communications may be processed on the basis of Art. 6(1)(f) GDPR; our legitimate interest is the proper handling and response to business inquiries. The required confirmation in the form that you have read the privacy information is intended to provide transparent information about the processing and does not automatically constitute consent to additional processing activities.
5. Email and SMTP processing
Quote requests are transmitted server-side through the configured email infrastructure to the business mailbox used to handle inquiries. If you provide a valid email address in the contact field, the system may also send an automatic receipt confirmation to that address. The message only confirms receipt of the inquiry and is not a booking or appointment confirmation. Credentials for the email configuration are stored outside the publicly accessible web directory.
6. Spam, misuse and security measures
To protect the quote form, we use server-side validation, a hidden honeypot field and time-limited request-rate controls. If the honeypot field, which is not intended for legitimate users, is completed by an automated program, the submission is not sent as a normal quote request. For form rate limiting, the IP address is not stored in plain text as form content; it is hashed to create a technical key, while associated timestamps are processed only for the short protection window required for this safeguard. Inputs are also checked server-side for permitted values, formats and lengths. The legal basis for this security processing is Art. 6(1)(f) GDPR.
7. Administrator area and technically necessary session data
The protected administrator area is intended solely for authorised administrators. A technically necessary secure session cookie is used for authentication. Security-relevant events such as sign-in attempts and password-reset requests may be logged server-side or temporarily protected by IP-based rate limits in order to prevent unauthorised access and misuse. Reset tokens are not stored in plain text but only as hashes; reset links are time-limited and single-use. This processing is used solely to secure the administration system and not to analyse public visitor behaviour.
8. Recipients and technical service providers
Personal data may be processed to the technically necessary extent by service providers that enable hosting, server operation or email communication. Such recipients receive data only to the extent required for the relevant technical or contractual service or where disclosure is legally required. The current website does not disclose personal data to third parties for advertising purposes.
9. Google Fonts
The current website loads fonts through Google Fonts (fonts.googleapis.com and related Google services). When a page is loaded, your browser therefore establishes a connection to Google servers; technically, your IP address and browser or connection information may in particular be transmitted to Google. This integration is used to provide consistent typography. If this external transfer requires a different technical or legal implementation, the integration must be adjusted accordingly.
10. Cookies, local storage, analytics and marketing
Based on the current implementation, the public website does not use its own analytics, advertising or marketing-tracking services and does not use its own Local Storage or Session Storage functionality to build profiles of public visitors. The protected administrator area uses only technically necessary session information for authentication and security. If analytics, marketing or other consent-dependent technologies are added in the future, this privacy information and, where required, the consent mechanism will be updated.
11. Retention
We retain personal data only for as long as necessary for the relevant purpose. Stand-alone inquiries are retained for handling and necessary follow-up. If an inquiry results in a contractual or business relationship, commercial or tax retention obligations may require longer storage. Short-term security and rate-limit data is retained only for the relevant protection window or for as long as necessary to prevent and investigate security-relevant events. Data is then deleted or anonymised unless statutory obligations or another lawful reason require continued retention.
12. Your rights
Subject to the statutory requirements, you have in particular the right of access under Art. 15 GDPR, rectification under Art. 16 GDPR, erasure under Art. 17 GDPR, restriction of processing under Art. 18 GDPR, data portability under Art. 20 GDPR, and the right to object to processing based on legitimate interests under Art. 21 GDPR. Where processing is based on consent, consent can be withdrawn for the future. Under Art. 77 GDPR, you also have the right to lodge a complaint with a competent data-protection supervisory authority.
13. HTTPS, external links, status and changes
The website is intended to be delivered over encrypted HTTPS so that data transmitted between your browser and the web server is protected against unauthorised interception. Absolute security of data transmission over the internet cannot be guaranteed technically. The website also contains links to external services, for example KF Prime Logistics. The respective external provider processes data under its own responsibility only when you follow such a link. This privacy information describes the functions currently implemented in the project and will be updated if the website or its data-processing activities change materially.