Skip to content

Privacy policy

Last updated: 9 November 2026

This privacy policy explains how we process personal data when you visit ksec.app, when you send the contact form, and when you write to us by email. KSec is a security posture platform for businesses. It is in development. The application is not available yet, so this policy covers the website only.

1. Who is responsible

The controller under the General Data Protection Regulation (GDPR) is:

ADIndeo GmbH
Mittelstr. 13c
13055 Berlin
Germany

Registered at the Amtsgericht Berlin (Charlottenburg), HRB 189857.

Email for privacy requests: hello@ksec.app

In this policy, “we”, “us” and “our” mean ADIndeo GmbH. “You” means the person whose data we process.

2. Hosting

Cloudflare Pages hosts the website. Cloudflare also delivers and protects all requests to ksec.app. When you open a page, your browser sends technical request data to Cloudflare. This data includes your IP address, the requested address, the time, and the browser identification (User-Agent). Cloudflare needs this data to deliver the page and to protect the website against attacks. Cloudflare keeps this data only as long as it needs it for delivery and security.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is a fast, available and secure website.

3. Cloudflare Web Analytics

The website uses Cloudflare Web Analytics to count page views and to measure page load times. Cloudflare states that Web Analytics does not use cookies or local storage, and that it does not identify individual visitors through their IP address or User-Agent. We receive only aggregated statistics. We do not receive data about individual visitors.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to understand which pages people read and how fast they load.

4. The contact form

When you send the contact form, we process your name, your email address, the name of your company if you give it, and your message. We use this data to answer your request.

The legal basis is Art. 6(1)(b) GDPR if your request is about a contract with us or the start of a contract. Otherwise, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to answer your request.

4.1 Bot check

The form uses Cloudflare Turnstile to check that a person, not a bot, sends it. For this check, Cloudflare processes technical data of your browser and of your request, for example your IP address. When you send the form, our server sends the check token and your IP address to Cloudflare to verify the check. We receive only the result of the check. We do not store your IP address.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to protect the form and our mailbox against spam and abuse.

4.2 Delivery to our mailbox

Our server sends the content of the form as one email to our mailbox through Resend. Our mailbox runs on Google Workspace (section 7). The website itself stores nothing from the form.

5. Contact by email

If you write to us by email, we process your email address, your name if you give it, and the content of your message. We use this data to answer you. Our mailbox runs on Google Workspace (section 7).

The legal basis is Art. 6(1)(b) GDPR if your message is about a contract with us or the start of a contract. Otherwise, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to answer your request.

6. Cookies

The website sets no cookies of its own. When Cloudflare checks a request for an attack, for example with a browser challenge or with the bot check of the contact form, Cloudflare can set a short-lived security cookie on ksec.app. This cookie is strictly necessary for security. The legal basis is § 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG).

7. Recipients and processors

We use these service providers. They process personal data on our behalf and follow our instructions under a data processing agreement (Art. 28 GDPR).

  • Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare hosts the website, delivers and protects all requests to ksec.app, runs the bot check of the contact form, and counts page views (section 3).
  • Plus Five Five, Inc. (“Resend”), 2261 Market Street #5039, San Francisco, CA 94114, USA. Resend delivers the messages of the contact form to our mailbox.
  • Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. Google hosts our mailbox (Google Workspace). It receives the messages of the contact form and the emails that you send to us.

We give personal data to authorities only if the law requires it.

8. Transfers outside the European Union

Cloudflare and Resend are in the USA. Data that they process can reach the USA. Google Cloud EMEA Limited is in Ireland. Google can also process the data of our mailbox in the USA, through Google LLC.

Cloudflare, Resend and Google LLC are certified under the EU-U.S. Data Privacy Framework. The European Commission decided on 10 July 2023 that the USA has an adequate level of protection for data that goes to certified companies (Art. 45 GDPR). The data processing terms of Cloudflare and Resend also contain the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

9. How long we keep data

  • The website stores no data from the contact form.
  • Messages from the form, and emails that you send to us, stay in our mailbox as long as we need them to handle your request, and as long as commercial or tax law requires.
  • Cloudflare keeps request data only as long as it needs it for delivery and security.
  • Web Analytics gives us only aggregated statistics.

10. Your rights

You have these rights under the GDPR:

  • You can ask for access to your data (Art. 15).
  • You can ask us to correct your data (Art. 16).
  • You can ask us to delete your data (Art. 17).
  • You can ask us to restrict the processing (Art. 18).
  • You can ask for your data in a structured, common and machine-readable format (Art. 20).
  • You can object to processing (Art. 21). See below.

To use one of these rights, write to hello@ksec.app. We answer within one month. If we must check your identity, we ask you for proof first.

Right to object. If we process your data on the basis of Art. 6(1)(f) GDPR, you can object to this processing at any time, for reasons that come from your particular situation. We then stop the processing, unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or unless we need the data to establish, exercise or defend legal claims.

11. Right to complain

You can complain to a data protection supervisory authority. The authority for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59-61
10555 Berlin
Germany

You can also complain to the authority in the member state where you live or work, or where the alleged infringement took place.

12. Further information

You do not have to give us personal data. Without your email address, we cannot answer your request.

We do not use automated decision-making or profiling under Art. 22 GDPR.

We change this policy when ksec.app or the law changes. The date at the top shows the last change.