Privacy Policy

As of: August 2026

This privacy policy describes which personal data we process when you use the website kontier.eu, for what purposes and on what legal basis, and which rights you have under the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

1. Data Controller

The data controller within the meaning of Art. 4(7) GDPR is:

Frontier Algorithmics UG (haftungsbeschränkt)
Koppoldstr. 1
86551 Aichach, Germany
Phone: +49 941 20902125
Email: contact@frontieralgorithmics.com
Represented by: Zaid Marzguioui

Commercial Register: HRB 20570, Local Court (Amtsgericht) Regensburg
Further mandatory information is available in our Legal Notice.

2. Data Protection Officer

We have not appointed a Data Protection Officer. Based on our assessment, no such obligation applies: Frontier Algorithmics UG (haftungsbeschränkt) does not meet the threshold set out in § 38(1) BDSG (generally at least 20 persons constantly engaged in the automated processing of personal data), nor do we process personal data in a way that mandates a DPO under Art. 37(1) GDPR. In particular, regular and systematic monitoring of data subjects on a large scale is not part of our core activities, and we do not process special categories of personal data within the meaning of Art. 9 GDPR on a large scale.

For data protection enquiries, please contact: contact@frontieralgorithmics.com.

3. Supervisory Authority

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data, without prejudice to any other administrative or judicial remedy.

The supervisory authority responsible for us is:
Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach, Germany
www.lda.bayern.de

Persons habitually resident in another EU Member State may additionally contact the data protection supervisory authority responsible for their place of residence.

4. Your Rights as a Data Subject

With respect to the personal data concerning you, you have the following rights:

• Access to the data being processed (Art. 15 GDPR)
• Rectification of inaccurate or incomplete data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR, "right to be forgotten")
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on Art. 6(1)(f) GDPR, and at any time to direct marketing (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

To exercise your rights, an informal message to contact@frontieralgorithmics.com is sufficient. We may, in individual cases, request additional information to verify your identity.

5. General Information about Data Processing

This privacy policy applies to the pages accessible at kontier.eu and kontier.eu/en as well as their sub-pages. Kontier is a B2B SaaS offering; the website is addressed to businesses, not to consumers within the meaning of § 13 BGB.

The overarching legal bases for our processing activities are:

• Art. 6(1)(a) GDPR - Consent
• Art. 6(1)(b) GDPR - Performance of a contract or pre-contractual measures
• Art. 6(1)(c) GDPR - Compliance with legal obligations (e.g., commercial and tax law retention obligations)
• Art. 6(1)(f) GDPR - Legitimate interest

Personal data is deleted as soon as the purpose of storage ceases to apply and no statutory retention obligations stand in the way. The specific retention period for each processing activity is stated in the relevant section below.

6. Hosting and Website Delivery

The website is operated on servers located within the European Union. The following hosting and infrastructure providers are used; each acts as a processor within the meaning of Art. 28 GDPR. Data processing agreements (Auftragsverarbeitungsverträge) are in place with all providers listed:

• IONOS SE & Co. KGaA, Elgendorfer Straße 57, 56410 Montabaur, Germany
• STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany
• Scaleway SAS, 8 rue de la Ville l’Évêque, 75008 Paris, France
• OpusDNS GmbH (DNS resolution)

All processing locations are situated within the EU/EEA; no transfer to third countries takes place in the context of hosting.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure, performant and reliable provision of the website).

7. Server Log Files

Each time a page is accessed, the web server automatically records technical information that your browser transmits. This includes:

• IP address (truncated/anonymized)
• Browser type and version
• Operating system used
• Referrer URL
• Hostname of the accessing device
• Date and time of the server request

Purposes: ensuring uninterrupted operation, detection and prevention of abusive access, and error analysis. This data is not merged with other data sources or used for profiling.

Retention period: as long as technically required for the security purposes mentioned above, typically up to 14 days.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in IT security and stable operation).

8. Contact and Demo Requests (Formbricks)

We collect contact and demo requests on the website using the open-source software Formbricks. Formbricks is operated exclusively on our own infrastructure under the subdomain surveys.kontier.eu. Frontier Algorithmics UG (haftungsbeschränkt) remains the controller; no transfer to an external provider takes place. Processing under Art. 28 GDPR is therefore not required because no third party is involved.

The forms are technically embedded as an iframe from surveys.kontier.eu. When the contact page is loaded, an additional connection is therefore established with this subdomain; technical connection data (e.g., IP address, time of access) is processed in the same way as described in section 7.

Fields collected:

• Name (mandatory)
• Email address (mandatory)
• Company (optional)
• Role or function (optional)
• Message (mandatory)

Demo requests may include additional questions about the company context. Mandatory and optional fields are marked as such in the form.

Purpose: handling your enquiry and any subsequent business communication.

Legal basis:

• Art. 6(1)(b) GDPR, where the enquiry aims at the conclusion of a contract or is of a pre-contractual nature.
• Art. 6(1)(f) GDPR otherwise (legitimate interest in responding to general enquiries).

Retention period: enquiries are deleted as soon as they have been finally dealt with and no further communication is to be expected, but at the latest six months after the conclusion of the correspondence, unless commercial or tax law retention obligations (in particular § 257 HGB, § 147 AO; up to 6 or 10 years for business letters and invoices) apply.

Product updates (newsletter)

On our website you can subscribe to product updates or the Kontier technical newsletter with integration examples and product offers. The Stripe-XRechnung integration pack is provided after confirmation of the newsletter subscription described in the form. The form is rendered directly on kontier.eu; no iframe is embedded for this.

Confirmation procedure (double opt-in). Submitting the form does not store a confirmed subscription. Your request is stored as pending and we send an email with a confirmation link. Only opening that link confirms the subscription. The link expires after seven days; this does not automatically delete the pending request. After successful confirmation your browser receives a protected seven-day receipt so the confirmation page and requested download remain available on reload.

Stored for your request and its confirmation status:

• Email address, name if provided, and company for trial invitation requests
• Language and originating page (technical, for attribution)
• Time and IP address of the request, and time and IP address of the confirmation, each with the browser identifier (user agent) used
• The exact consent wording and its version - solely to demonstrate consent under Art. 7 (1) GDPR

Storage is in our self-hosted Formbricks instance (surveys.kontier.eu). The confirmation email is dispatched by Scaleway SAS (France) as a processor via its Transactional Email service; processing takes place in the EU. Your email address, your name and the message content are transmitted for this purpose.

Purpose: sending the product updates, integration examples and product offers described in the respective form, and providing the requested integration pack.

Legal basis: Art. 6 (1) (a) GDPR (consent), and for promotional sending additionally § 7 (2) no. 3 UWG. Consent is voluntary; it is a precondition neither for using the website nor for entering into a contract. You may withdraw it at any time with effect for the future: via the unsubscribe link on the confirmation page and in every further email, or via the contact address given in the imprint. Withdrawal therefore needs no account and one click. The lawfulness of processing carried out before withdrawal remains unaffected.

Retention: until consent is withdrawn. After withdrawal, the consent evidence is retained only as long as necessary to defend against claims (as a rule three years, § 195 BGB).

9. Web Analytics with Umami (cookie-free)

For audience measurement we use the open-source web analytics tool Umami. Umami is operated exclusively on our own infrastructure under the subdomain analytics.kontier.eu; no transfer to third parties takes place.

General audience measurement with Umami operates deliberately cookie-free: it neither sets cookies nor stores or reads any other persistent identifiers on your device. To recognize sessions, a daily-rotating hashed value is generated server-side which can no longer be linked to a user after 24 hours. Because no information is accessed on, or stored in, your terminal device, consent under § 25(1) TDDDG (the German implementation of the ePrivacy Directive) is not required.

The following information is collected:

• page accessed (URL and title)
• referrer source
• browser type, screen resolution, language
• approximate region based on the truncated IP address
• selected events (e.g., clicks on the contact or demo tab, loading of the contact forms, clicks on navigation links)

Identification of individual visitors is not possible from this data.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly audience measurement to improve our website).

Right to object: you may object to this processing at any time in accordance with Art. 21 GDPR, e.g., by activating the "Do Not Track" browser header or by using a tracker blocker that prevents connections to analytics.kontier.eu.

This general audience measurement with Umami is therefore deliberately not part of the consent dialog described in section 12. § 25(1) TDDDG requires that information is stored in terminal equipment or that information already stored there is accessed. In our assessment, Umami does neither: it sets no cookies, writes or reads no LocalStorage, SessionStorage or IndexedDB entries, and uses no fingerprinting; recognition relies solely on a daily-rotating hash generated server-side. The provision is therefore not engaged at all, which means the exemption in § 25(2) no. 2 TDDDG does not need to be relied upon and no consent has to be obtained.

Separately, confirmed newsletter and invitation requests are measured as campaign events only after your consent to the "Marketing" category. To avoid counting the same request again on reload, the browser stores an opaque confirmation identifier in SessionStorage until the tab closes. It contains no email address or confirmation link. These optional events are also sent to our Umami instance; their storage access is separate from the general audience measurement described above.

The subsequent processing of the information transmitted in any event when you access a page is governed solely by Art. 6(1)(f) GDPR. Audience measurement therefore runs irrespective of the choice you make in the consent dialog; you may object to it at any time under Art. 21 GDPR in the manner described above.

10. Payment Processing via Stripe

For the processing of paid subscriptions (plans "Starter", "Scale" and "Enterprise") we use the payment service provider Stripe:

Stripe Payments Europe, Limited
1 Grand Canal Street Lower, Grand Canal Dock
Dublin, D02 H210, Ireland

Based on our legal assessment and on Stripe's data processing agreement, Stripe acts in part as a processor (for the handling of the specific payment and directly related data) and in part as an independent controller (in particular for fraud prevention, risk assessment and the fulfilment of Stripe's own regulatory obligations as a payment service provider).

When a contract is concluded via the Stripe-hosted checkout page, the following data in particular is processed:

• name and email address
• billing address (mandatory)
• VAT identification number, if provided
• payment method (credit card or SEPA direct debit); full card or bank details are processed exclusively by Stripe and are not disclosed to us
• selected subscription, language and country
• 14-day trial period and automatic tax calculation via Stripe Tax

Data may be transferred to Stripe, Inc. (United States) and thus to a third country. Stripe, Inc. is certified under the EU-US Data Privacy Framework (DPF); EU Standard Contractual Clauses (SCCs) and a data processing agreement with Stripe additionally apply.

Legal basis:

• Art. 6(1)(b) GDPR (performance of a contract) for the payment itself.
• Art. 6(1)(c) and (f) GDPR where Stripe processes data for fraud prevention or to fulfil its own regulatory obligations as an independent controller.
• Art. 44 et seq. GDPR in conjunction with the EU-US DPF and Standard Contractual Clauses for the transfer to the United States.

Retention period: contract and invoice data is retained pursuant to § 257 HGB and § 147 AO for up to 10 years after the end of the relevant fiscal year.

Further information about data processing by Stripe is available at: https://stripe.com/privacy

11. Stripe Customer Portal

Existing customers can manage their contract, invoice and payment data via the Stripe-hosted Customer Portal. Login takes place via a Stripe-provided login page using only the email address on file; a sign-in link is sent by email.

Within the portal, you can in particular:

• view and download invoices
• add, change or remove payment methods
• update billing address and VAT identification number
• cancel subscriptions at the end of the contract term

The categories of data processed in the portal correspond to those set out in section 10; the allocation of responsibility between Stripe and us applies accordingly.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

12. Consent Management (Consent Banner)

To obtain, manage and document consent we use the open-source consent manager vanilla-cookieconsent (version 3.1.0, MIT licence). The software is delivered from our own server together with the remaining files of the website. No content delivery network and no third-party server is contacted; no data is transmitted to the developers of the software. Frontier Algorithmics UG (haftungsbeschränkt) remains the sole controller for this processing.

The first time you access kontier.eu, a consent dialog is displayed. Until you have made a decision in that dialog, only the storage operations described under "Necessary" are carried out. Scripts in the "Marketing" category - in particular gtag.js for Google Ads conversion tracking (see section 13) - are neither loaded nor executed beforehand, and no connection to Google's servers is established. Declining is just as easy and given equal prominence as accepting.

We distinguish two categories:

• Necessary - always active and cannot be deselected. Comprises the consent cookie cc_cookie and the SessionStorage entry lang-checked, plus protected kontier_newsletter_receipt and, where applicable, kontier_newsletter_resource after newsletter confirmation (see section 14).
• Marketing - disabled by default and activated only by your active opt-in. Comprises Google Ads conversion tracking, the cookies _gcl_au, _gcl_aw and _gcl_dc set by Google in that context, our LocalStorage entry kontier_attribution and the duplicate-confirmation suppression identifiers described in section 14.

Your decision is stored in a first-party cookie named cc_cookie. This cookie contains nothing but the categories you selected, the time of the decision and a randomly generated consent ID. It contains no IP address, no name, no email address and no cross-site identifier, and it is not used to recognise you for any other purpose. The cookie is set and read solely by the domain kontier.eu and, as part of ordinary HTTP communication, transmitted only to our own server; it is not passed on to any third party.

Retention period: 12 months from the decision. After that the cookie expires and the consent dialog is displayed again.

Legal basis:

• § 25(2) no. 2 TDDDG for storing cc_cookie on your terminal equipment: without this cookie we could not give effect to your decision and would have to display the dialog on every page view.
• Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR for the subsequent processing: we are legally required to be able to demonstrate that consent was given.

Withdrawing or changing your decision: the "Cookie settings" link in the footer of every page reopens the consent dialog at any time, allowing you to deselect individual categories and thus withdraw your consent. Withdrawal is as easy as giving consent and takes effect for the future; the lawfulness of processing carried out up to the point of withdrawal remains unaffected (Art. 7(3) GDPR). After withdrawal, gtag.js is no longer loaded on subsequent page views. Google cookies already set, as well as the kontier_attribution entry, can additionally be deleted in your browser settings.

13. Google Ads Conversion Tracking

We advertise Kontier through search ads on Google Ads. To measure which campaigns actually lead to sign-ups, we use Google Ads conversion tracking. The provider is:

Google Ireland Limited
Gordon House, Barrow Street
Dublin 4, Ireland

Conversion tracking is activated only after your explicit consent in the "Marketing" category of the consent dialog (see section 12). Without that consent the Google script gtag.js is not embedded in the page, not loaded from www.googletagmanager.com and not executed; no connection to Google is established whatsoever.

Exactly two events are measured:

• the start of a free trial on the "Starter" and "Scale" plans
• the submission of an enterprise contact request

Once consent has been given, each page view necessarily transmits to Google, in particular, your IP address, information about your browser and operating system, the URL accessed, the referrer source and the time of access. Google processes this data in order to link an ad click to the subsequent event on our website. We ourselves receive only aggregated reports from Google (e.g., the number of conversions per campaign, keyword and ad group); we cannot identify individual users from them.

Stored on your terminal equipment once consent has been given:

• _gcl_au - a first-party cookie of the domain kontier.eu set by Google that attributes a visit to the ad that triggered it. Lifetime: approximately 90 days.
• _gcl_aw and _gcl_dc - set by Google only where your visit originated from an ad click, storing the corresponding click identifier. Lifetime: approximately 90 days each.
• kontier_attribution - our own entry in your browser's LocalStorage. It contains the campaign parameters utm_source, utm_medium, utm_campaign, utm_term and utm_content, the Google click parameter gclid, where applicable the intent parameter, the path of the landing page and a timestamp. Its purpose is to attribute a trial started later to the campaign that produced it. Lifetime: 90 days; older entries are no longer evaluated.

The parameters stored in kontier_attribution are additionally appended to internal links pointing to our pricing, checkout and sign-up pages so that the attribution survives the transition to portal.kontier.eu and app.kontier.eu. If you submit a contact or migration form, these parameters are transmitted to our own server together with your form entries and stored there with the enquiry (see section 8).

Google Consent Mode v2: we have implemented version 2 of Google's consent mode. The signals ad_storage, ad_user_data, ad_personalization and analytics_storage are set to denied by default. They are only updated to granted once you have actively confirmed the "Marketing" category. If you withdraw your consent, they are reset to denied.

Allocation of roles: the Google Ads Data Processing Terms apply to conversion tracking; to that extent Google processes the measurement data collected as a processor within the meaning of Art. 28 GDPR. Where Google uses the same data beyond that for its own purposes - for instance to improve its own advertising products - Google acts as an independent controller.

Third-country transfer: Google Ireland Limited may pass the data on to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google LLC is certified under the EU-US Data Privacy Framework. For transfers to certified US companies, the European Commission's adequacy decision of 10 July 2023 applies, so the transfer is permissible under Art. 45(1) GDPR without additional safeguards. Access by US authorities on the basis of intelligence powers cannot be entirely ruled out even under the adequacy decision; the decision provides for limitations to what is necessary and proportionate as well as for a remedy before the Data Protection Review Court.

Legal basis:

• § 25(1) TDDDG for storing the above cookies and the LocalStorage entry on your terminal equipment and for accessing them.
• Art. 6(1)(a) GDPR for the subsequent processing of the personal data collected in this way.
• Art. 45(1) GDPR in conjunction with the adequacy decision on the EU-US Data Privacy Framework for the transfer to the United States.

Retention period: the cookies and the LocalStorage entry expire after 90 days at the latest. Retention at Google is governed by Google's own rules; conversion data is kept there in aggregated form for a longer period for campaign reporting.

You can withdraw your consent at any time with effect for the future via the "Cookie settings" link in the website footer (Art. 7(3) GDPR). Independently of this, you can deactivate personalised advertising in your Google account at https://myadcenter.google.com .

Further information about data processing by Google is available at: https://policies.google.com/privacy

14. Cookies and Local Storage

Cookies are small text files that a website places in your browser; SessionStorage and LocalStorage are corresponding storage areas of the browser. We use as few of them as possible on kontier.eu. Without your consent, only the entries listed under "Necessary" are stored. All entries in the "Marketing" category are created only after your active opt-in in the consent dialog (see section 12).

"Necessary" category (no consent required, always active)

Legal basis: § 25(2) no. 2 TDDDG (storage access strictly necessary to provide a service you have expressly requested) and, for the subsequent processing, Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (record of consent) and Art. 6(1)(f) GDPR (legitimate interest in a correctly working language selection).

"Marketing" category (only after consent)

Legal basis: § 25(1) TDDDG for storing information on, and reading it from, your terminal equipment, and Art. 6(1)(a) GDPR for the subsequent processing. Details of Google Ads conversion tracking, including the transfer to the United States, are set out in section 13.

What we do not use

Beyond the table above we use no further tracking cookies. We embed no social media plug-ins, no third-party advertising networks, no chat widgets and no cross-site tracking scripts. Fonts and scripts are served from our own server; Google Fonts and comparable services are not loaded from external servers. Our audience measurement with Umami works entirely without cookies and without any access to your terminal equipment (see section 9).

Redirect to Stripe

During checkout you are redirected to pages operated by Stripe (checkout.stripe.com, billing.stripe.com, portal.stripe.com). Stripe may set its own cookies on these pages; these are governed exclusively by Stripe's privacy policy (see section 10) and are not covered by our consent dialog, because they are not set on kontier.eu.

Your own controls

Independently of the consent dialog, you can inspect cookies as well as Session and LocalStorage in your browser settings at any time, delete them individually or entirely, and block them in future. If you delete cc_cookie, we no longer know your decision and the consent dialog will be shown again on your next visit. Blocking all cookies may mean that the language selection and the checkout process no longer work correctly.

15. Changes to this Privacy Policy

We update this privacy policy when legal requirements or the procedures actually used on the website change. The version published at https://kontier.eu/en/datenschutz is always authoritative. The date stated above reflects the current version.

---

As of: August 2026