Skip to content
Let's talk →
Legal

Privacy Policy

Last updated: August 2026

We keep this simple, because our data collection is simple: the contact form, the mailing-list signup, and visitor statistics that run on our own server and store nothing on your device. We don't run ads, we don't sell data, and we don't track you around the internet. That is also why you were not asked to accept cookies — we don't set any.

1. Who is responsible

The controller responsible for data processing on this website is:

Found Key Solutions UG
Johannesstr. 19
99084 Erfurt, Germany
Email: via our contact page

2. What we collect, and why

Contact form. When you send us an inquiry, we collect the details you enter — typically your name, email address, company, and the message itself. We use this data only to respond to your inquiry and, if things move forward, to prepare a possible engagement. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract) and Art. 6(1)(f) GDPR (our legitimate interest in answering inquiries directed at us). Your inquiry is delivered to a mailbox we operate with Google Workspace, and you receive an automatic confirmation at the address you gave us, quoting what you sent.

Mailing list. If you sign up for our insights mailing list, we collect your email address and use it solely to send you that mailing. The legal basis is your consent, Art. 6(1)(a) GDPR. Alongside the address we record the time of signup and the IP address it came from, so that a subscription can be shown to be genuine if it is ever disputed (Art. 7(1) GDPR). Every mailing contains an unsubscribe link, and you can withdraw your consent at any time with effect for the future; following that link deletes the entry outright rather than merely marking it inactive.

Server logs. Like almost every website, our hosting provider automatically records technical access data (IP address, browser type, time of access) in server logs for security and stability purposes. These logs are not merged with the data above and are deleted on a routine schedule.

3. Cookies and analytics

We set no cookies. This website stores nothing on your device for statistics — no cookies, no local storage, no fingerprinting. That is why there is no cookie banner: § 25 TDDDG requires your consent for storing information on your device or reading what is already there, and we do neither. The only exception is described under Form protection below, and it is strictly necessary for a service you asked for.

Visitor statistics. We use Umami, an open-source analytics tool that we run ourselves on our own server in Germany. No data is passed to any third party, and none leaves the EU. For each page you open it records the address of the page, the site or search engine you came from, any campaign tags in the link, your approximate country and region, and general details of your browser, operating system, device type, screen size and language. It also records a small number of actions on the site — that a contact form or mailing-list signup was sent, which call-to-action was used, and whether a submission failed — but never what you typed into a form.

How visits are counted without cookies. Instead of recognising your device, the software derives a one-way hash from your IP address, your browser's user agent and an identifier for this website, mixed with a value that changes at the start of every month. Your IP address itself is not stored. Once the monthly value changes, earlier visits can no longer be connected to later ones. The legal basis is Art. 6(1)(f) GDPR: our legitimate interest in knowing which pages are read and which are not, in a form that is as sparing as we could make it. Statistics are deleted after 24 months.

Your right to object. Because this rests on legitimate interest, you may object at any time under Art. 21 GDPR, with no reason required and with effect for the future. The button below does precisely that, for the browser you are reading this in. We also honour your browser's “Do Not Track” setting — with it enabled nothing is collected in the first place — and with JavaScript switched off the statistics script never runs at all.

Spam protection. The forms are protected by Cloudflare Turnstile, operated by Cloudflare Ireland Limited. The moment you start filling one in, it loads a script from challenges.cloudflare.com and sends Cloudflare your IP address together with technical signals from your browser, which is how it tells a person from a bot. Turnstile sets no advertising cookies and does not follow you across websites. Because it is what keeps the forms usable at all, it runs without asking: the legal basis is Art. 6(1)(f) GDPR (our legitimate interest in forms that are not flooded by bots). It loads only on pages carrying a form, and only once you touch one.

Form protection. When you use the contact form, we store a timestamp in your browser's session storage to stop the same form being submitted repeatedly by bots. It is deleted when you close the tab, never leaves your device, and is strictly necessary for a service you asked for. Our server also counts submissions per IP address for a short time for the same reason; that count lives in memory only and is never written to disk.

4. What we don't do

We don't sell or rent your personal data to anyone.
We don't use advertising cookies — we set no cookies at all — and we don't track you across other websites.
We don't use your inquiry data for marketing unless you separately opt in to the mailing list.

5. Who processes the data

Your data is processed by us and by the service providers we need to run this website:

IONOS SE (Germany) — the server this site runs on, located in Germany,
Cloudflare Ireland Limited — the network the site is delivered through, and the spam protection on the forms,
Google Ireland Limited — the mailbox that receives your inquiry and sends our email.

Where we use such providers, we have data processing agreements in place per Art. 28 GDPR, and we prefer providers that process data within the EU. Visitor statistics involve no provider at all: that software runs on the same German server as this website, and the data stays there.

6. How long we keep it

Contact inquiries are kept as long as needed to handle your request, plus any retention period required by law if an engagement follows. Mailing-list data is kept until you unsubscribe, at which point the entry is deleted immediately. Visitor statistics are deleted after 24 months.

7. Your rights

Under the GDPR you have the right to:

access the personal data we hold about you (Art. 15),
have it corrected (Art. 16) or deleted (Art. 17),
restrict processing (Art. 18) or object to it (Art. 21),
receive your data in a portable format (Art. 20),
withdraw any consent at any time, with effect for the future,
lodge a complaint with a data protection supervisory authority.

To exercise any of these rights, just contact us — no special form required.

8. Changes to this policy

If our data practices change — for example, if we add new tools to the website — we'll update this policy and the date at the top. The current version always applies.

Skip to content
Found Key
Solutions
Legal

Privacy Policy

Last updated: August 2026

We keep this simple, because our data collection is simple: the contact form, the mailing-list signup, and visitor statistics that run on our own server and store nothing on your device. We don't run ads, we don't sell data, and we don't track you around the internet. That is also why you were not asked to accept cookies — we don't set any.

1. Who is responsible

The controller responsible for data processing on this website is:

Found Key Solutions UG
Johannesstr. 19
99084 Erfurt, Germany
Email: via our contact page

2. What we collect, and why

Contact form. When you send us an inquiry, we collect the details you enter — typically your name, email address, company, and the message itself. We use this data only to respond to your inquiry and, if things move forward, to prepare a possible engagement. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract) and Art. 6(1)(f) GDPR (our legitimate interest in answering inquiries directed at us). Your inquiry is delivered to a mailbox we operate with Google Workspace, and you receive an automatic confirmation at the address you gave us, quoting what you sent.

Mailing list. If you sign up for our insights mailing list, we collect your email address and use it solely to send you that mailing. The legal basis is your consent, Art. 6(1)(a) GDPR. Alongside the address we record the time of signup and the IP address it came from, so that a subscription can be shown to be genuine if it is ever disputed (Art. 7(1) GDPR). Every mailing contains an unsubscribe link, and you can withdraw your consent at any time with effect for the future; following that link deletes the entry outright rather than merely marking it inactive.

Server logs. Like almost every website, our hosting provider automatically records technical access data (IP address, browser type, time of access) in server logs for security and stability purposes. These logs are not merged with the data above and are deleted on a routine schedule.

3. Cookies and analytics

We set no cookies. This website stores nothing on your device for statistics — no cookies, no local storage, no fingerprinting. That is why there is no cookie banner: § 25 TDDDG requires your consent for storing information on your device or reading what is already there, and we do neither. The only exception is described under Form protection below, and it is strictly necessary for a service you asked for.

Visitor statistics. We use Umami, an open-source analytics tool that we run ourselves on our own server in Germany. No data is passed to any third party, and none leaves the EU. For each page you open it records the address of the page, the site or search engine you came from, any campaign tags in the link, your approximate country and region, and general details of your browser, operating system, device type, screen size and language. It also records a small number of actions on the site — that a contact form or mailing-list signup was sent, which call-to-action was used, and whether a submission failed — but never what you typed into a form.

How visits are counted without cookies. Instead of recognising your device, the software derives a one-way hash from your IP address, your browser's user agent and an identifier for this website, mixed with a value that changes at the start of every month. Your IP address itself is not stored. Once the monthly value changes, earlier visits can no longer be connected to later ones. The legal basis is Art. 6(1)(f) GDPR: our legitimate interest in knowing which pages are read and which are not, in a form that is as sparing as we could make it. Statistics are deleted after 24 months.

Your right to object. Because this rests on legitimate interest, you may object at any time under Art. 21 GDPR, with no reason required and with effect for the future. The button below does precisely that, for the browser you are reading this in. We also honour your browser's “Do Not Track” setting — with it enabled nothing is collected in the first place — and with JavaScript switched off the statistics script never runs at all.

Spam protection. The forms are protected by Cloudflare Turnstile, operated by Cloudflare Ireland Limited. The moment you start filling one in, it loads a script from challenges.cloudflare.com and sends Cloudflare your IP address together with technical signals from your browser, which is how it tells a person from a bot. Turnstile sets no advertising cookies and does not follow you across websites. Because it is what keeps the forms usable at all, it runs without asking: the legal basis is Art. 6(1)(f) GDPR (our legitimate interest in forms that are not flooded by bots). It loads only on pages carrying a form, and only once you touch one.

Form protection. When you use the contact form, we store a timestamp in your browser's session storage to stop the same form being submitted repeatedly by bots. It is deleted when you close the tab, never leaves your device, and is strictly necessary for a service you asked for. Our server also counts submissions per IP address for a short time for the same reason; that count lives in memory only and is never written to disk.

4. What we don't do

We don't sell or rent your personal data to anyone.
We don't use advertising cookies — we set no cookies at all — and we don't track you across other websites.
We don't use your inquiry data for marketing unless you separately opt in to the mailing list.

5. Who processes the data

Your data is processed by us and by the service providers we need to run this website:

IONOS SE (Germany) — the server this site runs on, located in Germany,
Cloudflare Ireland Limited — the network the site is delivered through, and the spam protection on the forms,
Google Ireland Limited — the mailbox that receives your inquiry and sends our email.

Where we use such providers, we have data processing agreements in place per Art. 28 GDPR, and we prefer providers that process data within the EU. Visitor statistics involve no provider at all: that software runs on the same German server as this website, and the data stays there.

6. How long we keep it

Contact inquiries are kept as long as needed to handle your request, plus any retention period required by law if an engagement follows. Mailing-list data is kept until you unsubscribe, at which point the entry is deleted immediately. Visitor statistics are deleted after 24 months.

7. Your rights

Under the GDPR you have the right to:

access the personal data we hold about you (Art. 15),
have it corrected (Art. 16) or deleted (Art. 17),
restrict processing (Art. 18) or object to it (Art. 21),
receive your data in a portable format (Art. 20),
withdraw any consent at any time, with effect for the future,
lodge a complaint with a data protection supervisory authority.

To exercise any of these rights, just contact us — no special form required.

8. Changes to this policy

If our data practices change — for example, if we add new tools to the website — we'll update this policy and the date at the top. The current version always applies.