Privacy notice

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

keyONE GmbH
Auf der Schled 16
66822 Lebach
Germany

Telephone: +49 6881 595 38 62
Email: info@keyone.one

Privacy contact
Christian Schorr
Auf der Schled 16
66822 Lebach
Germany

Mobile: +49 174 3443815
Email: c.schorr@keyone.one

Please use this direct contact for privacy-related requests. Further company information is available in our Legal Notice.

This notice applies to the public websites keyone.one and keyone.de, including the international xCASE profiles on keyone.one. It describes the processing required to deliver and secure the website, respond to enquiries and—only with your consent—measure and improve the regular website. The reduced xCASE profiles do not load optional analytics services; no analytics consent is therefore required on those pages.

Depending on the purpose, processing is based on Article 6(1)(b) GDPR for pre-contractual communication, Article 6(1)(c) GDPR for legal obligations, Article 6(1)(f) GDPR for our legitimate interests in secure and reliable website operation and appropriate business communication, or Article 6(1)(a) GDPR for optional analytics. No automated decision-making with legal or similarly significant effects takes place through this website.

When you request a page, our web server technically processes the IP address, date and time, requested address, referring page where transmitted, browser and operating-system information, HTTP status and transferred data volume. This is necessary to deliver the requested content, maintain availability, investigate faults and attacks and prevent misuse.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure, stable and efficient operation of the website and the protection of our systems. Access and error logs are rotated daily; fourteen daily rotations are retained. An individual entry may be retained for longer where a documented security incident requires investigation or where a legal obligation applies.

The website uses only the following strictly necessary cookies without optional consent:

• keyone-session assigns a server-side session to the browser. It expires after two hours and is protected by Secure, HttpOnly and SameSite=Lax.
• XSRF-TOKEN protects requests against cross-site request forgery. It expires after two hours and is protected by Secure and SameSite=Lax.
• KEYONE_PRIVACY_PREFERENCES stores your privacy selection for 180 days so that it can be applied on subsequent visits. It is protected by Secure and SameSite=Lax and must be readable by the consent component in the browser.

The storage of and access to these items is necessary to provide the website and the privacy selection you requested and is based on section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). Associated personal-data processing is based on Article 6(1)(f) GDPR and, where required to document and respect your choice, Article 6(1)(c) GDPR.

Analytics services are disabled by default. They are loaded only after you have actively selected the optional Analytics group. The legal bases are your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG.

You can refuse optional services without losing access to the website. You can also change or withdraw your choice at any time with effect for the future by selecting Privacy settings in the footer. Withdrawal does not affect the lawfulness of processing before withdrawal. When the configured services or purposes change, the consent revision is increased and a new decision is requested.

Analytics services are loaded only if you consent to the Analytics group. If you select Necessary only, no Google or Microsoft analytics script is loaded and no analytics data is transmitted by this website.

Google Tag Manager and Google Analytics 4

We use Google Tag Manager (container GTM-NQPGFJ2Q) to control the consent-dependent delivery of Google Analytics 4 (measurement ID G-PFT3THNJ8Q). The Tag Manager itself is loaded only after you have consented. The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics measures page views, source of access, an approximate country or region, general device and browser characteristics and interactions with the website. We use these reports to understand whether content is found, where technical or editorial problems occur and how the website can be improved.

Google Analytics may set the first-party cookies _ga and _ga_<measurement-id> for up to two years. In the Analytics property used here, event-data retention is set to two months and user-data retention to a fixed maximum of 14 months; the user-data period is not reset by new activity. Aggregated standard reports may remain available independently of these settings. Advertising storage, advertising user data, personalised advertising and Google Signals are disabled. Google Ads may receive non-personalised measurement data through the existing product link, but the link is not permitted to use Analytics data for personalised advertising. Automatic collection of user-provided data, form-interaction measurement and detailed location and device data are disabled. Email addresses and common URL query parameters containing personal data are redacted where they can be detected before storage. Google may process data in countries outside the EEA, including the United States. Google refers to the EU–US Data Privacy Framework and, where required, standard contractual clauses as transfer safeguards. Further information is available in the Google Privacy Policy, the Google Analytics cookie documentation and the data-retention information.

Microsoft Clarity

We use Microsoft Clarity (project ID rfbi6imv1y) to understand the rendered page and pseudonymous interactions such as clicks, scrolling, pointer or touch movement and navigation paths. Clarity provides aggregated metrics, heatmaps and session replays that help us identify usability and presentation problems. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

Clarity may process a pseudonymous identifier, browser and device data, the visited address, interaction and rendering data and an approximate region derived from the IP address. With consent, it may use the first-party cookies _clck and _clsk and the Microsoft cookies CLID, ANONCHK, MR, MUID and SM. The Clarity project uses Strict masking: visible page text and user-entered content are masked in recordings in accordance with Clarity's rules. No account, contact or application form is currently evaluated with Clarity on the website. The Clarity project is connected to the GA4 property described above; both services are activated on this website only within the same consent group. Microsoft Ads and Google Ads integrations are disabled for Clarity.

Under the Clarity Terms, Microsoft and keyONE are independent controllers for the personal data processed in connection with Clarity. Microsoft may use the data it receives for the purposes described in the Microsoft Privacy Statement, including providing and improving Microsoft services and creating user profiles. Playback data is retained by Microsoft for 30 days; click and heatmap data and sessions explicitly labelled or favourited in Clarity are retained for up to nine months. Microsoft may process data outside the EEA, including in the United States, on the basis of applicable adequacy decisions and contractual safeguards. Further information is available in the Microsoft Privacy Statement, the Clarity Terms, the Clarity cookie documentation, the Clarity retention information and the GA4 integration description.

If you contact us by email or telephone, we process the information you provide, your contact details and the content and time of the communication in order to answer your enquiry and handle any subsequent communication.

Where the enquiry concerns a contract or steps prior to entering into a contract, the legal basis is Article 6(1)(b) GDPR. For other business enquiries it is Article 6(1)(f) GDPR; our legitimate interest is to respond appropriately and maintain business communication. Statutory retention duties, particularly for business correspondence, remain unaffected.

Providing your data is voluntary. Without the contact details and information needed to handle the matter, however, we cannot answer your enquiry. You are not required to provide any additional data.

The website contains ordinary links to LinkedIn and, on the Directions page, to Google Maps, Apple Maps and OpenStreetMap. No social plugin or external map is embedded when the page is loaded. Data is therefore not transmitted to these providers merely because you visit our website.

A connection to the selected provider is established only when you follow a link. The provider then receives at least the requested address and technical connection data such as your IP address; if you are signed in, the visit may also be associated with your account. The provider is responsible for the subsequent processing under its own privacy terms.

Within keyONE GmbH, only those persons who need the data for the stated purpose receive access. We may also use carefully selected hosting, IT, communication and analytics service providers. Where these providers act on our behalf, they are contractually bound in accordance with Article 28 GDPR. Google acts as a processor for the Analytics data collected on our instructions; the optional Google products and services data-sharing setting is disabled. Microsoft and keyONE act as independent controllers for Clarity as described above.

Data is transferred outside the European Economic Area only where this is necessary for an expressly selected service and an applicable adequacy decision, standard contractual clauses or another lawful safeguard is in place. The specific transfer information for Google and Microsoft is set out in the analytics section above.

We retain personal data only for as long as it is required for the respective purpose, legal retention period or the establishment, exercise or defence of legal claims. The specific periods for server logs, necessary cookies and analytics data are stated above. Enquiry data is deleted when the matter is concluded and no contractual or statutory retention requirement remains.

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. You may object to processing based on Article 6(1)(f) GDPR for reasons arising from your particular situation. Consent can be withdrawn at any time with effect for the future through Privacy settings in the footer or by contacting us.

You also have the right to lodge a complaint with a data-protection supervisory authority. The authority responsible for our registered office is the Independent Data Protection Centre Saarland, Fritz-Dobisch-Straße 12, 66111 Saarbrücken, Germany.

Version: 5 September 2026. We update this notice when processing activities, services or legal requirements change. A new date is shown only for a substantive change.