Privacy

Valid from: April 9, 2026

1. General Information

This Privacy Policy explains how Kukan UG (haftungsbeschränkt) collects and processes personal data through the website kukan.ai and our social media profiles. Personal data means any information relating to an identified or identifiable natural person, including name or IP address.

Data Controller:
Kukan UG (haftungsbeschränkt)
Brunnenstrasse 41, 10115 Berlin, Germany
Email: hello@kukan.ai
Legal representative: Gerrit McGowan
Data protection inquiries: hello@kukan.ai

Legal bases for processing:

  • Art. 6(1)(a) GDPR: Processing with your consent
  • Art. 6(1)(b) GDPR: Contract performance and pre-contractual measures
  • Art. 6(1)(c) GDPR: Compliance with legal obligations
  • Art. 6(1)(f) GDPR: Legitimate interests (answering inquiries, website security)

Data transfers outside the EEA are protected by EU Commission adequacy decisions, the EU–U.S. Data Privacy Framework, or standard contractual clauses where no adequacy decision exists.

Storage durations:

  • Contact form inquiries: 6–12 months after resolution
  • CRM data: Duration of relationship plus 3 years
  • Log files: Maximum 14 days
  • Google Analytics: 14 months
  • Accounting documents: 10 years (§147 AO)
  • Commercial correspondence: 6 years (§257 HGB)

Your rights as a data subject:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to object (Art. 21 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to withdraw consent (Art. 7(3) GDPR)

Exercise your rights by contacting: hello@kukan.ai

Right to lodge a complaint with the supervisory authority:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Friedrichstr. 219, 10969 Berlin | Phone: +49 30 13889-0
Email: mailbox@datenschutz-berlin.de | www.datenschutz-berlin.de

No fully automated decision-making per Article 22 GDPR is used as standard practice. Mandatory data fields are marked on the website; refusal to provide mandatory data may result in contract rejection or service discontinuation.

Making contact: When you contact us by email or form, we collect your name, email address, telephone number (if provided), and message content. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries) or Art. 6(1)(b) GDPR for pre-contractual enquiries. Data is deleted or anonymised 6–12 months after resolution.

Customer surveys: Periodic surveys are conducted to understand customer needs. Legal basis: legitimate interest in service improvement. Data is deleted once survey results have been evaluated.

Direct marketing (cold outreach): We may send a single unsolicited B2B email to businesses that may benefit from our services, using publicly available contact data (company websites, Google Maps, public directories). Legal basis: Art. 6(1)(f) GDPR and §7(2) UWG. You may object at any time by replying to the email or contacting hello@kukan.ai — we will immediately cease contact and add you to our permanent suppression list. Non-responsive data is deleted within 90 days.

2. Data Processing on Our Website

Website visitors from Germany: We store or access terminal equipment information (cookies, IP addresses) either on the basis of technical necessity (§25(2)(2) TTDSG) or with your consent (§25(1) TTDSG). See our Cookie Policy for details.

Informative use of the website: When you visit our website, your browser automatically transmits the following data, which we store temporarily in log files for up to 14 days for security and stability purposes: IP address, date and time of request, time zone, page requested, HTTP status code, data volume transferred, referrer URL, browser type and version, operating system, and language settings. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in website security and functionality).

Web hosting: Our website is hosted by Squarespace, Inc., 8 Clarkson Street, New York, NY 10014, USA. Squarespace processes content, usage, meta, and contact data in the EU and USA. Squarespace is certified under the EU–U.S. Data Privacy Framework. Privacy policy: squarespace.com/privacy

Contact form: Data submitted via the contact form (name, email address, message, and any voluntarily provided information) is stored solely for the purpose of processing and responding to your enquiry. Legal basis: Art. 6(1)(f) or Art. 6(1)(b) GDPR. Data is deleted 6–12 months after resolution; contract-related enquiries may be retained up to 3 years.

HubSpot CRM: We use HubSpot CRM for customer relationship management. Provider: HubSpot, Inc., 25 First Street, Cambridge, MA 02141, USA. Data processed: contact data (name, email, company), usage data, content data (inquiry details), meta data (device, IP). Processing takes place on EU servers. HubSpot is EU–U.S. Data Privacy Framework certified; a Data Processing Agreement per Art. 28 GDPR is in place. Retention: duration of relationship plus 3 years. Privacy policy: legal.hubspot.com/privacy-policy

Google Analytics 4: With your consent, we use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to understand how visitors interact with our website. Data collected: pages visited, time spent, interactions, device type, browser, and anonymised IP address. IP anonymisation is activated — IP addresses are shortened within the EU/EEA before any transmission to the USA. Legal basis: Art. 6(1)(a) GDPR and §25(1) TTDSG (consent). Data is automatically deleted after 14 months.

Withdraw consent at any time via: (1) the cookie banner, (2) the Google Analytics Opt-out Add-on, or (3) hello@kukan.ai. Google LLC is EU–U.S. Data Privacy Framework certified. Further information: policies.google.com/privacy

3. Data Processing on Social Media Platforms

We maintain organisational profiles on social media platforms for service presentation and stakeholder communication. Platform operators process user data for advertising and research purposes and may store cookies on your device. Servers may be located outside the EU. When you contact us via social media, we process your message data to respond to your enquiry. Legal basis: Art. 6(1)(f) GDPR. Retention: typically 6–12 months after the last interaction.

LinkedIn: Operator: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. LinkedIn processes data for targeted advertising and analytics. We act as joint controller for certain page analytics (Page Insights). Privacy policy: linkedin.com/legal/privacy-policy | Opt-out: linkedin.com/psettings

Instagram: Operator: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. Meta processes data for advertising, personalisation, and analytics. We act as joint controller for business page insights. Privacy policy: instagram.com/legal/privacy | Opt-out via Settings > Privacy and Security > Data Sharing.

Facebook: Operator: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. Meta processes data for advertising, personalisation, and analytics. Meta bears primary responsibility for Page Insights data and handles data subject rights requests relating to that processing. Privacy policy: facebook.com/privacy/policy | Opt-out via Settings & Privacy > Ads > Ad Preferences.

4. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy to reflect changes in our practices, technology, legal requirements, or other factors. The current version is always available on this page. The “Valid from” date at the top indicates the last revision. We will notify you of material changes via a prominent notice on the website prior to the changes taking effect. We encourage you to review this policy periodically.

5. 3D Scene Content & Personal Data

Kukan creates interactive 3D scenes of physical spaces using photogrammetry and Gaussian Splat technology. During the capture process, incidental personal data may be recorded — for example, vehicle licence plates, individuals present in the space, or other identifying information visible in the environment at the time of capture.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in providing accurate spatial representations of our clients’ spaces.

Your right to request restriction or erasure: If you believe your personal data has been incidentally captured in one of our 3D scenes, you have the right to request restriction of processing (Art. 18 GDPR) or erasure (Art. 17 GDPR). To submit a request, contact privacy@kukan.ai with a description of the scene and the nature of the data concerned.

How we handle requests: Upon receiving a valid request, we will take the affected scene offline while we assess and address the concern. We aim to respond to all requests within 30 days. Please note that due to the technical nature of Gaussian Splat rendering, permanent automated redaction of specific elements within a scene is not currently possible. Where erasure cannot be achieved by technical means, we will assess whether the scene can remain published, must be restricted, or must be permanently removed, on a case-by-case basis.

Retention: 3D scene data is retained for the duration of the client contract. Scenes are unpublished upon contract termination.

6. Questions and Comments

If you have any questions or comments about this Privacy Policy, or wish to exercise your GDPR rights, please contact:

Kukan UG (haftungsbeschränkt)
Brunnenstrasse 41, 10115 Berlin, Germany
Email: privacy@kukan.ai