Datenschutz

Privacy notice

Draft. Written for a privacy-by-design setup. Add the controller’s full address and have it reviewed before launch. A German version is required for German visitors.

1. Controller

Dela Kunzmann, Physical AI Pflege Lab (in Gründung), Eschweiler Straße 16A, 50933 Köln. Email: hello@physical-ai-care.com.

2. Browsing this website

The site is served by Cloudflare, Inc. as hosting and security provider. To deliver pages and protect the site against attacks, Cloudflare processes technical data such as your IP address, browser type and request time (Art. 6(1)(f) GDPR — legitimate interest in a secure, working website). We use no analytics, no tracking pixels, no advertising and no marketing cookies, and we embed no third-party content. Because no non-essential cookies or similar technologies are used, no cookie banner is shown (§ 25(2) TDDDG).

3. Contact form

When you send the form we process the details you enter: your role, name, email address, message and the optional fields for your visitor type (for engineers optionally a CV as PDF). Purpose: answering your enquiry and, where you wish, preparing a collaboration. Legal basis: your consent (Art. 6(1)(a) GDPR) and pre-contractual steps (Art. 6(1)(b) GDPR). You can withdraw consent at any time by email; this does not affect processing carried out before withdrawal.

Submissions are stored in an access-restricted database (Cloudflare D1) and CVs in a private, non-public storage bucket (Cloudflare R2), both in Cloudflare’s EU jurisdiction where available. To prevent abuse we store a salted, one-way hash of your IP address for rate-limiting — never the IP address itself.

4. Cloudflare Turnstile

To protect the form against spam and bots we use Cloudflare Turnstile. It is loaded only on the contact page, when the form comes into view. Turnstile evaluates technical signals from your browser to tell humans and bots apart and does not use cookies for advertising. Our server checks the result with Cloudflare before any message is accepted. Legal basis: Art. 6(1)(f) GDPR (protection against abuse). Cloudflare may process data in the USA; transfers are based on the EU–US Data Privacy Framework and standard contractual clauses. See Cloudflare’s privacy policy.

5. Retention and deletion

Contact submissions and CVs are deleted automatically six months after receipt, unless a collaboration follows — then we keep them only as long as that requires and tell you.
Rate-limiting hashes are deleted after 24 hours.
You can ask for earlier deletion at any time.

6. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object (Art. 21), and the right to withdraw consent. You may complain to a supervisory authority, for example the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).

7. Security

All connections are encrypted (HTTPS/TLS). The site sets strict security headers, contains no third-party scripts except Turnstile on the contact page, and never exposes credentials in the browser.

Last updated: October 2026.