Privacy Policy

Controller

The controller for the processing of personal data described here is Kandyb Studio - Paweł Kandybowicz, ul. Żytnia 16 lok. 8, 01-014 Warszawa, Poland, support@kandyb-studio.eu. We are not required to appoint a data protection officer; please send requests to that address.

What we process

• Your email address, for the order confirmation, delivery of the report, status messages and support.
• If you requested a launch notification: your email address, chosen language, the time of registration and the page where you registered.
• The plot details you submit: address text, coordinates, parcel identifier (Flurstückskennzeichen) and municipality.
• The report itself and the files generated from it.
• Server logs: IP address, time, requested path and browser identification.

Purposes and legal bases

• Ordering, producing, delivering and supporting the report: performance of the contract, Article 6(1)(b) GDPR.
• Accounting and tax records: legal obligation, Article 6(1)(c) GDPR.
• Secure operation, debugging and abuse prevention: legitimate interests, Article 6(1)(f) GDPR.
• One notification when the report opens: your consent, Article 6(1)(a) GDPR.

Notification when the report opens

If you registered for it, we use your email address once to tell you that the report can be ordered. You may withdraw your consent before that message is sent by emailing support@kandyb-studio.eu. We delete the entry after sending the message or after you withdraw.

Service providers and payment

OVH SAS runs the server that hosts the application and the reports, located in France inside the EU. Hostido runs the mailbox and outgoing mail for the grund-check.de domain, located in Poland inside the EU.

Payments use Stripe. Stripe Payments Europe, Limited, Ireland, provides the hosted payment page and processes payment details, email address, amount, order identifier and technical connection data. You enter card details directly with Stripe; they do not pass through our server. Stripe may transfer data to affiliates and providers outside the EEA, including the United States, and identifies the EU-US Data Privacy Framework and EU Standard Contractual Clauses as transfer mechanisms. See Stripe's Privacy Policy.

AI-assisted text in the report

The assessments in the report are written by a language model. Individual wordings that are missing from our own translation catalogue are machine-translated as well. The provider receives only the parcel details (parcel identifier, location description, municipality, federal state, official area, source and retrieval date) and the findings the report read from the public services. Your email address, your name and your payment details are never sent, and neither is parcel geometry or a raw service response.

The usual provider is OpenAI (USA). If OpenAI does not answer, xAI (USA) takes over, and translation may additionally run through Google. Each provider acts as a processor under its own data-processing terms and receives only the details listed above. For transfers to the United States we rely on the EU Standard Contractual Clauses and, where the provider is certified, on the EU-US Data Privacy Framework. The legal basis is performance of the contract, Article 6(1)(b) GDPR.

Figures, distances, dates and source references in the report come from the services themselves, not from the model. The model only writes the text around them.

Third-party content your browser loads

The map on the home page loads map tiles directly from Mapbox, Inc. (api.mapbox.com). Mapbox receives your IP address and browser technical details because they are needed to deliver the map. We use no other map provider. Your browser loads the Leaflet library and all fonts only from grund-check.de.

Address search and parcel lookup

Address search and parcel matching run through our own server. It queries the Mapbox, Inc. address search (Mapbox Geocoding) and the official geodata services of the federal states, and sends only the search text or the coordinates. Your IP address is not part of those requests. For the report our server works out drive times with Mapbox Directions and reads ground levels and water areas from Mapbox map tiles. Only the coordinates of the parcel and of the destinations go to Mapbox, nothing about you. Climate figures come from the German Weather Service (DWD) and from DWD, European Environment Agency and Copernicus Climate Change Service datasets kept on our own server; the DWD receives only the coordinates of the parcel, not your IP address. OpenStreetMap data comes from a Geofabrik extract kept on our own server; we send no requests to OpenStreetMap's servers for it.

Counting visits without cookies

We count how many people open the pages and which pages are read. Each page view is stored with the date and time, the path requested, the IP address shortened by its last byte (203.0.113.0 rather than 203.0.113.47), the browser language, the device class and the referring site. To group one visit's page views we derive a check value from those details; it changes every midnight and cannot be turned back into an address.

Nothing is written to or read from your device for this: no cookie, no local storage, no tracking pixel and no third-party service, so section 25 TDDDG does not apply. The legal basis is our legitimate interest in statistics about the use of our own site, Article 6(1)(f) GDPR. You may object under Article 21 GDPR. Entries are deleted after 90 days.

Google Analytics and Google Ads, only after consent

If you press "Accept all" in the cookie notice, we load Google Analytics and Google Ads from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Only then does Google set cookies and receive data about your visit: the pages opened, your IP address and whether an order was placed. We use it to see which advert produced a sale. Before you agree the Google script is not loaded and your browser makes no connection to Google. The legal basis is your consent, section 25(1) TDDDG and Article 6(1)(a) GDPR. Google also processes the data in the United States, under the standard contractual clauses and the EU-US Data Privacy Framework. The cookie policy explains how to withdraw.

Retention

The report, the private link and the email address stored with it are deleted automatically after 90 days. Server logs are deleted after 14 days. Visit-counting entries are deleted after 90 days. Accounting records are kept for as long as tax law requires.

No sale of data, no automated decisions

Data is not sold to third parties. Data reaches Google only if you agreed in the cookie notice, and only to the extent described above; nothing is shared with any other advertising network. Without consent, counting happens on our own server only. There is no automated decision-making that produces legal effects concerning you, no profiling and no scoring of people: the report is built from public data about a plot of land, not from an assessment of you.

Your rights

• Access to the data we hold about you, Article 15 GDPR.
• Rectification of inaccurate data, Article 16 GDPR.
• Erasure, Article 17 GDPR, unless a retention duty applies.
• Restriction of processing, Article 18 GDPR.
• Data portability, Article 20 GDPR.
• Objection to processing based on legitimate interests, Article 21 GDPR.

Any consent you have given can be withdrawn at any time with effect for the future. Write to support@kandyb-studio.eu with enough detail for us to identify your order.

Complaints to a supervisory authority

You can complain to a data protection supervisory authority. At the controller's seat that is the President of the Personal Data Protection Office (UODO) in Poland. In Germany the authority of the federal state where you live is responsible.

We update this policy when the processing changes; the date at the end of the page shows the current version.

Version: 2026-09-12