Privacy Policy

This privacy policy informs you about the nature, scope and purpose of the processing of personal data on this website. Last updated: August 2026.

1. Controller

Kempkens × Kohler GmbH · Pienzenauerstrasse 14, 81679 Munich, Germany · Commercial register HRB 283499 · Email: kempkens@kempkenskohler.com. A data protection officer is not required by law and has not been appointed.

2. Your rights at a glance

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing (Art. 21). Any consent given may be withdrawn at any time with effect for the future (Art. 7(3)). You also have the right to lodge a complaint with a supervisory authority — the competent authority here is the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany. An informal message to the address above is sufficient to exercise your rights.

3. Right to object where we rely on legitimate interests

Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time on grounds relating to your particular situation. We will then stop processing the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish or defend legal claims.

4. Hosting

This website is hosted with Netlify (Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA). Content is delivered via a global content delivery network that includes locations within the EU, so requests are normally served from a European location. As Netlify is a US company, access from the USA cannot be ruled out. Technically necessary data (including your IP address) is processed when you visit the site; the legal basis is our legitimate interest in secure and efficient delivery (Art. 6(1)(f) GDPR). A data processing agreement is in place with Netlify; any transfers to the USA are safeguarded by the EU Standard Contractual Clauses and the EU–US Data Privacy Framework.

5. Server log files

Each time the site is accessed, information transmitted by your browser is recorded automatically: browser type and version, operating system, referrer URL, hostname, time of the server request and IP address. This data serves technical delivery and security purposes and is not combined with other data sources (Art. 6(1)(f) GDPR). It is deleted or anonymised after 30 days at the latest.

6. Consent management (cookie banner)

On your first visit, a banner asks for your consent. It relates solely to the newsletter sign-up, which runs on the service involve.me and is loaded only once you agree. Your choice is stored solely in your own browser (localStorage, key kxk-consent-v1) and is not transmitted to us. You can change or withdraw your choice at any time via the “Cookie settings” link in the footer. We do not use any cookies for analytics, tracking or advertising, and we do not embed any third-party advertising or analytics services.

7. Fonts (self-hosted)

We use the Sofia Sans typeface for consistent presentation. It is served exclusively from our own server; no connection is made to third-party servers (such as Google Fonts) and your IP address is not transmitted to third parties.

8. Contacting us

You can reach us by email (kempkens@kempkenskohler.com, kohler@kempkenskohler.com) or by telephone. We process the details you provide solely in order to handle your enquiry. The legal basis is the initiation or performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR). We delete your enquiry once it has been dealt with conclusively, unless statutory retention obligations apply — commercial and tax law provide for retention periods of six and ten years respectively.

9. Contact forms and newsletter (involve.me)

We use the service involve.me (involve.me GmbH) for contact and requirement forms and for the newsletter sign-up.

Contact form: It is embedded in the relevant pages and is loaded as soon as the page opens. For technical reasons your IP address is transmitted to involve.me in the process. The legal basis is our legitimate interest in providing a working contact channel and the initiation of a contract (Art. 6(1)(f) and (b) GDPR). The details you enter are only transmitted once you submit the form.

Newsletter: The sign-up is loaded only after you give consent; until then no connection is made for it. The legal basis is your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time via the unsubscribe link or by email. Following withdrawal we remove your data from the distribution list.

10. Market Intelligence tools

The tools in the Market Intelligence section (Executive Hiring Index, Leadership Change Tracker, Growth Radar, Executive Salary Calculator) display aggregated market data only. When you open the Leadership Change Tracker or the Growth Radar, their content is loaded from our database at Supabase; for technical reasons your IP address is transmitted to the database server in the process. The legal basis is our legitimate interest in providing this content (Art. 6(1)(f) GDPR). Any entries you make in the salary calculator are processed in your browser only and are not transmitted to us. The underlying market data comes from public sources; your data is not passed on to those sources.

11. Database and feedback function (Supabase)

We use Supabase (Supabase Inc., with its parent company domiciled in the USA) as our database. The instance used for this website is operated in the Frankfurt am Main region (EU), so your data is stored within the European Union. A data processing agreement is in place with Supabase; any access from third countries is safeguarded by the EU Standard Contractual Clauses. A feedback function, which serves internal coordination only and is not active for regular visitors, may store comments about the website in this database.

12. Recipients of your data

Your data is passed on only where this is necessary to provide the website and handle your enquiry. Recipients are the processors named in this policy (hosting, form and newsletter tool, database) and — where legally required — public authorities. We do not sell your data.

13. No automated decision-making

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place on this website.

14. Provision of your data

Providing your data is neither legally nor contractually required. However, without the details needed to contact you we cannot process your enquiry.

15. Data security

We use SSL/TLS encryption to protect the transmission of your data. You can recognise an encrypted connection by the https:// in your browser’s address bar.

16. Updates and changes

This privacy policy will be adapted whenever changes to our processing activities or to the legal situation make this necessary. The version published on this page at the relevant time applies.