EN
DEPrivacy Policy
Updated: 3 November 2026
Controller: Dr. Kiran Ramesh Mahajan, trading under the name Kriya Partners
Address: Oberbrunner Str. 23, 81475 Munich, Germany
Telephone: +49 152 51423370
Email: kmahajan@kriya-partners.com
Company status: The formation of a limited liability company under the name Kriyanta is being prepared. Until a separate legal entity becomes the controller, Dr. Kiran Ramesh Mahajan is responsible for the personal-data processing described here.
1. Data protection officer
We currently understand that we are not required to appoint a data protection officer. For privacy questions, please use the contact details above. This position should be reviewed if our processing operations or legal obligations change.
2. Website access and hosting
This website is delivered through Netlify (Netlify, Inc., United States). The Plus Jakarta Sans font and the JavaScript libraries used for the site's design and functionality are served from our own website hosting. Optional Google Ads conversion tracking is described separately in section 6.
When you access our website, Netlify may process technical information to deliver and protect the website, including your IP address, the date and time of access, the requested URL, browser and device information, referral data where available, HTTP status and transferred data volume.
Our basis for technically necessary processing is Article 6(1)(f) GDPR: our legitimate interest in operating a secure, reliable website. Where a provider processes data for us as a processor, an agreement in accordance with Article 28 GDPR is required. Transfers to countries outside the EEA must be covered by a valid adequacy decision or appropriate safeguards under GDPR Chapter V.
3. Contact form
When you contact us through our form, we process the information you enter, which may include your name, email address, telephone number, subject and message, in order to respond to your request. Required fields are indicated; other details are voluntary.
Contact-form submissions are processed and stored by Netlify Forms. Notifications about new submissions are sent by Netlify directly to our Kriya Partners business mailbox in Microsoft 365.
The legal basis is Article 6(1)(b) GDPR for communications relating to prospective contracts, and otherwise Article 6(1)(f) GDPR for handling business inquiries. See section 8 for retention information.
4. Other communications
If you contact us by email, telephone or LinkedIn, we process your name, contact details and the content of your message to respond to your inquiry. The legal basis is Article 6(1)(b) GDPR where the communication relates to a contract and Article 6(1)(f) GDPR for other business correspondence. LinkedIn processes personal data under its own privacy policy.
5. Cookies and consent management
We use a first-party preference interface for necessary storage and optional Google Ads conversion tracking. Marketing tracking is off by default. Visitors can accept or reject Marketing and change their choice at any time through the cookie-preferences control or the link in the footer. The choice is retained using browser localStorage, not a conventional consent cookie.
The preference and its timestamp are stored locally in your browser. They are shared between the English and German pages on the same host. No separate server-side consent record is created by the current first-party interface.
Optional technologies require consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Technically necessary storage of your preferences may fall under the exemption in section 25(2) TDDDG, together with the applicable GDPR legal basis for associated personal-data processing.
6. Google Ads conversion tracking
We advertise using Google Ads, operated in Europe by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Where you consent, conversion measurement may help us understand whether an advertisement leads to an inquiry, such as a contact-form submission or an email link click.
Our website code activates the Google Ads conversion tag only after consent to the Marketing category. With Marketing rejected, this tag is not initiated by the first-party consent code. The locally hosted font and script resources required to display this website are separate from optional Google Ads conversion tracking.
The legal basis for optional tracking is Article 6(1)(a) GDPR and section 25(1) TDDDG. Consent can be withdrawn through Cookie Settings with effect for the future. After you consent to Marketing, our website's Google Ads integration communicates the relevant consent status when activating Google's tag. Google may process data in the United States under applicable transfer mechanisms. See Google's Privacy Policy.
7. Recipients and international transfers
Depending on the relevant processing purpose, recipients include Netlify (website hosting and forms), Microsoft 365 (business email and form notifications), Google Ads (only for optional conversion tracking after Marketing consent).
Business correspondence and website contact-form notifications are handled directly through Microsoft 365, with form submissions initially processed by Netlify Forms. Where service providers process personal data on our behalf, applicable contractual data protection requirements apply. Transfers outside the EEA require an applicable adequacy decision or appropriate safeguards under GDPR Chapter V.
8. Retention periods
Technical access data is handled and deleted or anonymized under the relevant provider's security and retention policies. We retain business inquiries only as long as required for the purpose or a legal obligation; where no contract is concluded, our intended maximum period is generally 24 months unless another legal ground applies. Consent decisions are retained according to the configured system and applicable evidentiary requirements. You may also delete optional cookies through your browser settings.
9. Client and project data
This notice concerns visits to this website and inquiries through the channels described above. Personal data processed in client transformation or restructuring engagements is governed by the relevant services agreement and, where required, a separate data processing agreement under Article 28 GDPR.
10. Your rights
Subject to applicable law, you may request access to, rectification or erasure of your personal data, restriction of processing, and data portability. You may withdraw consent at any time with effect for the future.
Right to object: Where processing is based on legitimate interests under Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation under Article 21 GDPR. You can do so by emailing us at the address above.
We do not make automated individual decisions concerning website visitors within the meaning of Article 22 GDPR.
11. Right to lodge a complaint
You have the right to complain to a data protection supervisory authority. Our relevant supervisory authority is the Bavarian Data Protection Authority for the Private Sector (BayLDA), Promenade 18, 91522 Ansbach, Germany; email: poststelle@lda.bayern.de.
12. Changes to this policy
We update this notice when our processing activities, providers or legal requirements change.