Last updated: 19 October 2026. English translation of the German privacy notice.
1. Controller and contact
The controller responsible for personal data processing on this website is K. E. Vermögen und Beteiligung GmbH, Theklaerstraße 51, 04347 Leipzig, Germany, represented by Kirk Eschberger.
Email: buero@kirkeschberger.de
Phone: +49 341 2328215
2. Website visits and hosting
Our website and email mailbox are hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When you access the website, the hosting provider processes technical connection data, including your IP address, the time of the request, the page or file requested, response status, data volume, browser information and any referring page sent by your browser.
This processing delivers the website, helps diagnose errors and protects it against attacks. Its legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website.
STRATO states that it retains IP addresses for detecting and preventing attacks for no more than seven days. According to STRATO, the access logs supplied to hosting customers contain anonymised IP addresses. Further information is available in STRATO's hosting privacy information.
We do not use advertising trackers or analytics services such as Google Analytics or Matomo on this website. Fonts, photos and the Leaflet map library are loaded from our own webspace. This does not establish a connection to an external font or library provider.
Audience measurement with Cloudflare Web Analytics
To understand which pages are used and how fast they load, we use Cloudflare Web Analytics (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). The service works without cookies and does not track individual visitors across websites. It records the page visited, referrer URL, browser, operating system, device type, the country derived from the IP address and page load times. When the measurement script (static.cloudflareinsights.com) is loaded and the measurements are sent, Cloudflare technically receives your IP address. No information is stored on your device. Individual measurements are aggregated into statistics after about seven days. We cannot identify you personally. The legal basis is our legitimate interest in designing the website according to demand and performance (Art. 6(1)(f) GDPR). A data processing agreement with Cloudflare is in place; for any transfer to the USA Cloudflare relies on the EU-US Data Privacy Framework and standard contractual clauses.
3. Contact by email or form
If you contact us, we process your contact details, your enquiry and any further correspondence to handle your request. The form requires your name, email address, subject and message. Providing this information is voluntary and is not a statutory requirement. The form cannot be submitted without the required fields. You can also contact us by phone or email.
Where your enquiry concerns a contract with you or steps taken at your request before entering into a contract, the legal basis is Article 6(1)(b) GDPR. We handle other enquiries under Article 6(1)(f) GDPR. Our legitimate interest is appropriate communication with prospective customers and other contacts.
Form submissions are emailed to our office. Recipients are the people handling your enquiry and STRATO as the hosting and email service provider. Form contents are not stored in an additional enquiry database on the website.
Retention depends on how long your details are needed to handle your enquiry and necessary follow-up questions. Where statutory retention duties apply, or data is necessary to establish, exercise or defend legal claims, the relevant information is retained for that purpose. Otherwise, the data must be deleted once its processing purpose no longer applies.
4. Contact form security
The form uses a session cookie called “__Secure-kirk_contact” to protect against forged and automated requests. It contains a random session identifier and is configured as a browser-session cookie. The associated form authorisation is valid for no more than two hours. The cookie securely provides the form you choose to use, under Section 25(2)(2) of Germany's Telecommunications Digital Services Data Protection Act (TDDDG). The related processing is based on our legitimate interest in protecting the form, Article 6(1)(f) GDPR.
To limit repeated submission attempts, the server also processes a value derived from your IP address using a secret key, together with attempt timestamps. This application state does not store your raw IP address, name, email address or message. Only attempts from the previous hour count towards the limit. Older entries are removed on the next permitted processing operation. Hosting logs and the enquiry sent by email are separate from this state.
5. Cloudflare Turnstile
When you first interact with the contact form, it loads Turnstile, a security service from Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. It checks whether a request comes from a person or an automated system. Cloudflare processes information including your IP address and browser and connection signals. Our server sends the verification token and your IP address to Cloudflare for validation, not your message text.
The legal basis for protecting the form is Article 6(1)(f) GDPR, our legitimate interest in preventing spam and abuse. Any storage of or access to information on your device that is strictly necessary for this expressly requested security service is based on Section 25(2)(2) TDDDG. If you do not wish to use Turnstile, you can contact us directly by email or phone.
Cloudflare processes security signals as a processor when protecting our website. It states that it acts as a separate controller when improving its bot detection. Processing may also take place in the USA. Cloudflare identifies the EU-US Data Privacy Framework and standard contractual clauses as grounds for international transfers. Details of processing, retention and safeguards are provided in the Turnstile Privacy Addendum, Cloudflare Privacy Policy and Data Processing Addendum.
6. Optional OpenStreetMap street map
You can use the location markers and list without loading an external street map. Only when you select “Load street map” does your browser request map tiles from the OpenStreetMap Foundation (OSMF), United Kingdom. The service receives your IP address and technical browser and request data, including the requested map areas and referring website. OSMF supplies map tiles through a worldwide server network, so data may also be processed outside the EU. Further information is available in the OSMF Privacy Policy.
The legal basis is your consent under Article 6(1)(a) GDPR and, where information is stored on or accessed from your device, Section 25(1) TDDDG. Activation applies only to the page currently open. You can withdraw your consent at any time by selecting “Disable street map”. No further map tiles will then be requested. Withdrawal does not affect the lawfulness of earlier transfers. You can access all location information without giving this consent.
7. External links
Links to our venues' websites, Facebook and other external pages open services operated by their respective providers. We do not embed Facebook content or social media plugins. The external provider is responsible for data processing after you open its page.
8. Your rights
Subject to the legal conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). Please use the contact details above to exercise these rights.
Right to object: Where we process your data under Article 6(1)(f) GDPR, you may object under Article 21 GDPR on grounds relating to your particular situation.
You can withdraw consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing before you withdrew consent.
You may lodge a complaint with a data protection supervisory authority, particularly in the place where you habitually reside, work or believe an infringement occurred. The authority responsible for us is the Saxon Data Protection and Transparency Commissioner.
On this website, we do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR.