KERNITY

    Privacy Policy

    This statement describes the personal data processed when you visit this website. It is based on a technical audit of the site as actually served: every processing operation described here was measured in a browser rather than copied from a template.

    Last reviewed: 5 August 2026

    1. In brief

    Who is responsible? Matthias Sammer, Sankt Margarethen 194a, 6220 Buch in Tirol, Austria — contact@kernity.ai.

    What data is collected? If you are only reading: nothing beyond the technical details your browser has to send the server anyway. Everything else — booking an appointment, emailing us — only happens if you start it yourself.

    What for? To deliver and secure the website, and to answer your enquiries. Not for advertising, and not to analyse your behaviour.

    Are cookies set? No.

    Your rights: access, rectification, erasure, restriction, portability, objection, and withdrawal of any consent you have given — see section 9. Complaints go to the Austrian Data Protection Authority.

    2. Controller

    Matthias Sammer (sole proprietorship) Sankt Margarethen 194a 6220 Buch in Tirol Austria

    Email: contact@kernity.ai

    No data protection officer has been appointed; there is no obligation to appoint one under Art. 37 GDPR.

    3. What happens when you open a page

    This website is hosted by Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA. When you open a page, your browser necessarily transmits technical data to their servers. Essentially:

    • the address requested and the amount of data transferred,
    • the date and time of the request,
    • browser type and version, and operating system,
    • the page you came from (referrer), if your browser sends it,
    • your IP address.

    A data processing agreement with Netlify is in place. It states expressly that Netlify will under no circumstances act as a controller of this data, but only as a processor acting on our instructions.

    • Purpose: delivering the website, operational security, defending against attacks.
    • Legal basis: Art. 6(1)(f) GDPR. Legitimate interest in operating the site securely and without faults.
    • Retention: for access logs Netlify states less than 30 days. For security and system logs the data processing agreement provides for retention on-line for 90 days and offline for 1 year.
    • We do not see these logs. Netlify states that it does "not share this information outside of Netlify, not even with the site operator(s)". We therefore never learn our visitors' IP addresses.
    • Transfer to the USA: Netlify, Inc. is a US company. The transfer takes place primarily on the basis of the EU-U.S. Data Privacy Framework, for which Netlify is certified. Only where a transfer is not covered by it, or if the Data Privacy Framework falls away, do the European Commission's Standard Contractual Clauses apply instead. The two mechanisms therefore apply alternatively, not cumulatively.
    • Sub-processors: Netlify maintains the current list at netlify.com/legal/subprocessors and notifies us at least 30 days before any change.
    • After termination the data is exported or deleted at our election.

    4. What is stored in your browser

    This website sets no cookies. It remembers exactly two things — and each only if you use the function in question yourself:

    • Your choice of language, once you switch between German and English using the language selector. It stays until you clear this site's data in your browser.
    • Your decision about the booking calendar, once you load it or decline it. It applies to the current browser window only and is gone as soon as you close the tab.

    Both are simple settings with no personal reference — no identifier by which you could be recognised. They stay in your browser and are transmitted neither to us nor to anyone else. Because you request both functions yourself, they are necessary for the service you asked for (§ 165(3) Austrian Telecommunications Act 2021).

    Your consent to the booking calendar is deliberately not stored persistently — that is by design: reloading the page or closing the tab withdraws it.

    5. Appointment booking via Cal.com (only after your consent)

    The "Erstgespräch" / contact page offers online appointment booking. The calendar is only loaded once you explicitly ask for it. Until then you see only an explanatory notice, and no connection to Cal.com is made.

    If you choose "Load calendar", content is retrieved from the servers app.cal.eu, cal.eu and www.cal.eu. Your IP address is transmitted to those servers in the process, and the provider may set its own cookies there. Everything you then enter into the calendar — typically your name, email address and preferred time — is processed by the provider on its own infrastructure.

    • Provider: Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA. We are the controller for the booking; Cal.com acts as our processor. A data processing agreement under Art. 28 GDPR was concluded on 5 August 2026.
    • Data processed: under that agreement, principally name, email address, calendar availability, meeting details and booking data, together with IP address and device, log and usage data.
    • Where it is stored — data stays in the EU: for data processed through cal.eu in the EU (Frankfurt) hosting region, the agreement commits the provider to store and process it in the EU/EEA and not to intentionally store, host or transfer it outside the EEA. Access from outside the EEA is limited to what is necessary for support, security, incident response and service continuity, and must carry additional safeguards. This commitment expressly overrides the agreement's general transfer provisions.
    • Where a transfer to the USA does occur, it is governed by the European Commission's Standard Contractual Clauses.
    • Important — this changes in November 2026: the EU commitment above applies expressly only to data processed through cal.eu. The provider has announced that it will shut down cal.eu on 1 November 2026 and migrate usage to the international cal.com platform. For new bookings the contractual EU storage commitment will therefore fall away and the general transfer provisions will apply instead. We will revise this section before the migration and describe the position that then applies.
    • Legal basis: Art. 6(1)(a) GDPR (your consent, given by clicking). You can withdraw it at any time by reloading the page or closing the tab.
    • Retention: the agreement states no fixed period — data is retained for the duration of the Services. We keep booking data for as long as we need it to prepare, hold and follow up the appointment, and then delete it from the booking account. After the contract ends there is an export window of at least 30 days, after which the provider deletes the data; it may persist for limited periods in backups, logs and security records. If the appointment leads to an engagement, the resulting business records are additionally subject to the statutory seven-year retention period (§ 132 Austrian Federal Fiscal Code).
    • Sub-processors: the provider maintains a public list at cal.com/privacy and normally gives 30 days' notice of material changes, which we may object to.

    If you would rather not load the calendar, you can email us instead. Nothing is withheld from you for choosing that.

    6. Contacting us by email

    If you write to us, we process your email address and the content of your message in order to answer it.

    • Legal basis: Art. 6(1)(b) GDPR for enquiries about a contract or its formation, otherwise Art. 6(1)(f) GDPR.
    • Email provider: we use Microsoft 365. Our contracting party and processor is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland — a company established in the EU.
    • Where it is stored: for Microsoft 365 customers whose sign-up location is in the EU or EFTA, Microsoft applies the EU Data Boundary: customer data is stored and processed in datacentres within the EU or EFTA. Microsoft also states that there are narrowly defined, documented circumstances in which data is still transferred outside that boundary; for those, Microsoft relies on Standard Contractual Clauses.
    • Retention: we keep correspondence for as long as we need it to deal with the matter. Where it concerns a business transaction, the statutory retention period of seven years also applies (§ 132 Austrian Federal Fiscal Code). Microsoft does not retain the messages independently of us — they sit in our mailbox and are deleted when it is cleared.

    There is no contact form on this website. The email address shown simply opens your own mail program.

    7. Interactive elements that transmit nothing

    The orientation tool ("Which starting point fits?") runs entirely in your browser. Your answers are held only in the page's memory and in the address bar. They are not transmitted to us or to anyone else, and are not stored anywhere.

    8. Categories of recipient

    We do not pass personal data on for advertising, sale or profiling. The only recipients are:

    • our hosting provider Netlify, Inc. (section 3),
    • the booking provider Cal.com, Inc., and only after your consent (section 5),
    • our email provider Microsoft Ireland Operations Limited when you contact us (section 6),
    • public authorities, where we are legally obliged to do so.

    9. Your rights

    You have the rights of access, rectification, erasure, restriction of processing, data portability and objection. Any consent you have given can be withdrawn at any time with effect for the future.

    To exercise these, contact contact@kernity.ai.

    If you believe that the processing of your data infringes data protection law, you may lodge a complaint with the supervisory authority. In Austria this is the

    Austrian Data Protection Authority (Österreichische Datenschutzbehörde) Barichgasse 40–42, 1030 Vienna Phone: +43 1 52 152-0 Email: dsb@dsb.gv.at Web: dsb.gv.at

    10. Scope of this statement

    This statement covers visiting this website only. We inform clients separately about the processing of customer and contract data when a contract is being entered into — that is the point at which such data is collected, and therefore the right place for the information required by Art. 13 GDPR. It is not missing here; it belongs elsewhere.