Privacy Policy

The controller responsible for processing personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is KFS GROUP GmbH. For questions about data protection and to exercise your rights, please use the contact details below.

On this website we only process the data needed to deliver the pages, to answer your enquiry or to handle your application.

We use no analytics or tracking tools, no advertising cookies and no social media plugins. That is why this website has no cookie banner.

This website is operated and delivered through the platform of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare serves the pages from a global network of data centres and protects them against attacks and overload.

Whenever a page is requested, Cloudflare processes technically necessary data: your IP address, date and time, the requested address, the previously visited page (referrer), and your browser and operating system. Without this data the website cannot be displayed.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is a fast, secure and stable website. Cloudflare processes the data as our processor under Art. 28 GDPR. Cloudflare is certified under the EU-U.S. Data Privacy Framework, so transfers to the USA rely on the European Commission's adequacy decision (Art. 45 GDPR), supplemented by EU Standard Contractual Clauses.

When your browser sends a request to our website application, for example through the automatic language selection on the start address or by submitting the contact form, Cloudflare logs technical data about the request as well as errors and security events such as rejected spam attempts. These entries may contain your IP address, the time and the requested address.

We use these logs only to fix errors and prevent abuse. They are deleted automatically after seven days at the latest. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure operation of the website.

The fonts on this website are stored on our own server and loaded from there. Your browser does not connect to Google or any other font provider.

We set a single cookie, and only when you choose a language yourself in the language switcher. The cookie “kfs_lang” contains nothing but the code of the chosen language, so that we can show you the website in that language on your next visit. It expires after twelve months and is not shared with third parties.

Storing this setting is strictly necessary for the service you explicitly requested (Section 25(2) no. 2 of the German TDDDG). The legal basis for the processing is Art. 6(1)(f) GDPR; our legitimate interest is to show you the website in your language.

If you open www.kfs-group.com without a language in the address, we forward you to the matching language version based on your browser's language setting. Nothing is stored on your device in the process. We do not use local storage, session storage or similar techniques, nor any analytics, tracking or advertising cookies.

When you write to us through the contact form, we process your details: first name, last name, email address, subject and message, and your phone number and company if you provide them. To protect against spam we also process your IP address, to limit the number of requests per minute, and the time at which you opened the form.

Your message is delivered to our mailbox as an email through the email service Mailjet (Mailjet SAS, 13-13 bis rue de l'Aubrac, 75012 Paris, France). Mailjet processes the data as our processor under Art. 28 GDPR.

The legal basis is Art. 6(1)(b) GDPR if your enquiry concerns a contract or steps prior to entering into one, otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering your enquiry. The spam check is based on Art. 6(1)(f) GDPR.

We delete your enquiry once it has been dealt with, unless statutory retention obligations require longer storage, for example six years for business correspondence under Section 257 of the German Commercial Code (HGB).

When you email or call us, we process your details to handle your request. Legal basis and retention follow the information on the contact form.

Our mailboxes, including the destination of the contact form, are operated by Microsoft Ireland Operations Limited, Dublin, Ireland, as part of Microsoft 365, acting as our processor. A transfer to Microsoft Corporation in the USA cannot be ruled out; Microsoft is certified under the EU-U.S. Data Privacy Framework.

The buttons for booking a meeting lead to Calendly, a service of Calendly LLC, USA. Calendly is not embedded in this website; a connection is only made when you click such a link. Calendly's privacy notice applies on the booking page.

If you book a meeting, we receive your name, email address, the chosen time and any details you add, so that we can prepare and hold the meeting. The legal basis is Art. 6(1)(b) GDPR. Calendly is certified under the EU-U.S. Data Privacy Framework.

The vacancies on our careers page come from our own applicant management system, KFS HUB. When you open the page, your browser loads the application module from app.kfs-group.com and the list of vacancies from KFS HUB; your IP address is processed technically in the process. KFS HUB data is hosted by Supabase, Inc., USA, in a data centre in the EU (Ireland).

When you apply, we process the details from the form: first and last name, email address, phone number, location, LinkedIn profile, preferred type of engagement and pay, cover letter, CV, further documents and your answers to questions about the position. We do not store your IP address in plain text, only as a hash value, in order to limit abuse.

The controller for your application is the KFS GROUP company named in the job posting, and KFS GROUP GmbH for unsolicited applications. Only the recruiting staff authorised for the position have access. KFS HUB notifies the recruiting team of a new application by email through the delivery service Mailgun (Mailgun Technologies, Inc., USA, sending through its EU region); this email contains only your name and the position, no documents. Supabase and Mailgun process the data as our processors; EU Standard Contractual Clauses apply to any access from the USA.

To help the recruiting team review applications faster, an AI service from OpenAI (OpenAI Ireland Limited, Dublin, Ireland) extracts key facts from CVs in PDF format, such as language skills, location, date of birth, professional experience, current position and profile links. OpenAI processes the data as our processor and does not use it to train its models. Data may be transferred to the USA in the process; EU Standard Contractual Clauses apply. Decisions on your application are made by people only.

The legal basis is Art. 6(1)(b) GDPR, taking steps prior to entering into an employment or service relationship. The AI-assisted review is based on Art. 6(1)(f) GDPR; our legitimate interest is prompt processing. We only add you to our talent pool with your consent (Art. 6(1)(a) GDPR).

We delete your application data six months after your most recent application or after a rejection. If you consented to the talent pool, we keep it for up to two years. If an employment or service relationship is established, we transfer the necessary data to the personnel file.

Our pages link to other services, for example to our company profile on LinkedIn. These are plain links without embedded content: data is only transferred when you click a link. The privacy policy of the respective provider then applies.

We store personal data only as long as necessary for the respective purpose or as required by statutory retention periods. The specific periods are listed in the sections above. After that we delete the data.

You have the right of access to the data we hold about you (Art. 15 GDPR), and the rights to rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR).

You can withdraw any consent you have given, for example for the talent pool, at any time with effect for the future (Art. 7(3) GDPR). This does not affect the lawfulness of processing carried out before the withdrawal.

To exercise your rights, a short informal message to info@kfs-group.com is enough.

Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.

You are under no statutory or contractual obligation to provide us with data. Without the mandatory fields in the contact or application form, however, we cannot process your enquiry or application.

There is no decision-making based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR.

We update this privacy policy whenever the website or the legal situation changes. The version published here applies.