Privacy Policy

1. Controller

The controller responsible for data processing is:

Nexana GmbH
Gewerbestrasse 10
6330 Cham
Switzerland

Email: info@kernas.de

2. What data we process

Depending on how Kernas is used, we process in particular:

• Contact and company data such as name, email address, phone number and company;
• User and account data;
• Contract, subscription and payment information;
• Technical data such as IP address, browser, device, time and duration of access;
• Support and communication data;
• Data, documents and other content that customers or their users enter or upload into Kernas.

Which customer data is stored within Kernas is generally determined by the respective customer.

3. Purpose of data processing

We process personal data in particular to:

• Provide and operate Kernas;
• Manage user accounts and subscriptions;
• Process payments;
• Communicate with customers and handle support requests;
• Ensure security and prevent misuse;
• Analyse and improve our website and services;
• Measure and optimise advertising campaigns;
• Fulfil legal obligations.

Insofar as the GDPR applies, processing is based in particular on contract performance, legitimate interests, fulfilment of legal obligations, or consent.

4. Customer data and data processing on behalf of customers

Customers may process personal data of their own employees, business partners or other individuals through Kernas.

The respective customer is generally the data controller for such data under data protection law. Kernas processes this data as a processor, only within the scope of the agreed services and the customer's instructions.

Details are governed by a data processing agreement.

5. Hosting and service providers

We use specialised service providers to operate Kernas.

These may include in particular:

• Hosting and infrastructure providers in Germany or the European Union;
• Payment service providers such as Stripe;
• AI service providers such as OpenAI, insofar as the relevant Kernas AI features are used;
• Providers of analytics, marketing, communication, security and support services.

These service providers only receive the data required for the respective service.

Personal data may be processed in particular in Switzerland, Germany, other EU/EEA member states, and the USA.

Where data is transferred to a country without a legally recognised adequate level of data protection, we use, where required, appropriate safeguards, in particular recognised standard contractual clauses or other legally provided protective mechanisms.

6. AI features

Kernas includes features that may use artificial intelligence.

When a user uses such a feature, the inputs, document excerpts or other data required for processing may be transmitted to an AI service provider we use.

Transmission is limited to the data required for the respective feature.

7. Cookies and consent management

Our website and application use cookies and comparable technologies.

Technically necessary technologies may be used without separate consent, insofar as they are required for operation, security, login, storage of settings, or other expressly desired functions.

For analytics, marketing and comparable non-essential technologies, we obtain the user's consent, where required, before activating them.

The following categories may be used in particular:

• Necessary: for operation, security and basic functions;
• Analytics: for statistical evaluation and improvement of our website;
• Marketing: to measure and optimise advertising campaigns and attribute conversions.

Non-essential technologies are only activated after corresponding consent.

Consent already given can be revoked or changed at any time via the Cookie settings available on the website. Revocation does not affect the lawfulness of processing carried out before the revocation.

8. Google Analytics

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics allows us to statistically analyse the use of our website. This may include information about pages viewed, interactions, devices and browsers used, the origin of the visit, and technical identifiers.

Google Analytics is only activated if the user has consented to the Analytics category.

Insofar as the GDPR applies, processing is based on consent pursuant to Art. 6(1)(a) GDPR.

Data may also be processed by affiliated Google companies, in particular Google LLC in the USA, in the course of providing the service.

9. Google Ads

We use Google Ads conversion tracking to measure the effectiveness of our advertisements and determine whether users take certain actions on our website after clicking on an ad, for example registering or completing a contract.

Cookies and comparable technologies, as well as technical information about the visit and the respective conversion, may be processed.

Google Ads is only activated if the user has consented to the Marketing category.

Insofar as the GDPR applies, processing is based on consent pursuant to Art. 6(1)(a) GDPR.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may also be processed by Google LLC in the USA.

10. Meta Pixel

We may use the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Ballsbridge, Dublin 4, Ireland.

The Meta Pixel allows us in particular to measure the effectiveness of advertisements on Facebook and Instagram and to determine whether users take certain actions on our website after seeing an advertisement.

Information about page views, interactions, browser and device data, and technical identifiers may be processed. Meta may combine such information with other information Meta holds about a user.

The Meta Pixel is only activated if the user has consented to the Marketing category.

Insofar as the GDPR applies, processing is based on consent pursuant to Art. 6(1)(a) GDPR.

Data may also be processed by companies of the Meta group outside Switzerland or the EEA.

11. Data transfer to the USA

Some service providers may process data in the USA.

Where a recipient is certified under an applicable data protection framework with a recognised level of protection, the transfer may be based on that certification. Otherwise, we use, where required, appropriate safeguards such as standard contractual clauses.

12. Retention period

We only store personal data for as long as necessary for the respective purposes or as required by statutory retention obligations.

Contract and billing data may be stored beyond the end of the contract due to statutory retention obligations.

Customer data is deleted after the contract ends, once it is no longer needed and there are no legal or contractual reasons for further retention. Data in backup systems is removed as part of the regular backup and overwrite cycles.

13. Data security

We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration or disclosure.

These include in particular access controls, permission systems, encrypted data transmission, and suitable security and backup procedures.

14. Rights of data subjects

Data subjects may, within the scope of applicable data protection law, request in particular information about their personal data as well as its correction or deletion.

Insofar as the GDPR applies, additional rights may include restriction of processing, data portability and objection, and consent given may be revoked for the future at any time.

Requests can be sent to info@kernas.de.

Data subjects also have the right to contact the competent data protection supervisory authority.

15. Changes

We may amend this privacy policy if our data processing activities or legal requirements change.

The version published on our website at the time applies.