Privacy policy
Privacy policy
Date: 4 November 2026
1. Controller
The controller responsible for processing personal data is:
Stefan Lang, trading as Lang KSTV
Schäferstraße 6
35315 Homberg (Ohm)
Germany
Telephone: +49 6633 918947
Email: service@langkstv.de
Website: https://www.langkstv.com/
2. Hosting, CDN and server logs
Our website, including the product designer, is hosted by:
Hostinger International Ltd.
61 Lordou Vironos Street
6023 Larnaca, Cyprus
The main server is located in Frankfurt am Main, Germany; under the current hosting settings, technical backups are stored in France. The Hostinger Content Delivery Network (CDN) additionally used may deliver content through different server locations, including outside the European Economic Area. Section 7 covers data processing agreements and international transfers.
Website visits involve processing, in particular, IP addresses, access times, requested pages and files including URL parameters, browser and operating system information, HTTP status codes, technical connection data and, where applicable, the previously visited website. This supports reliable operation, troubleshooting and protection against attacks and misuse. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is a secure and functional website.
Our domain langkstv.de redirects to www.langkstv.com. The redirection service may process technically necessary connection data.
Further information:
https://www.hostinger.com/legal/dpa
https://www.hostinger.com/legal/privacy-policy
3. Cookies and local storage
We do not use analytics or marketing services such as Google Analytics, Meta Pixel or newsletter tracking. Fonts, images and technical libraries are provided through our hosting, including the Hostinger CDN. Technically necessary browser checks and verification cookies may be used for security. When password protection for the product designer is enabled, we use strictly necessary cookies for sign-in and sign-in security (30 minutes). Without the optional “Stay signed in” selection, sign-in uses a session cookie. With this selection, sign-in is stored for 60 days after the last active use; further use renews this period. Sign-in also ends if you sign out, delete the sign-in cookies, or we remove or change the access credential or require a new sign-in.
Local storage in the product designer
The product designer stores configurations, designs, the enquiry list, drafts you choose to save and name, and preferences for the storage notice directly in your browser. Contact details from the enquiry form are not part of these locally stored drafts. Drafts are not automatically transmitted to us and remain on your device until you delete them through the product designer or your browser data settings. To prevent duplicate enquiries, a technical enquiry identifier and checksums are also stored locally, without storing contact details or messages in plain text. These technical records are deleted after the delivery confirmation has been processed; if the status is unclear, they remain until it is resolved or the browser data is cleared.
Storage or access strictly necessary for these functions is based on Section 25(2), point 2 TDDDG, the German Telecommunications Digital Services Data Protection Act. Where personal data is processed, Article 6(1)(b) GDPR applies to requested pre-contractual services, or Article 6(1)(f) GDPR applies based on our interest in functional and secure services.
Random gallery order
The random gallery order and home-page image selection are held only in the temporary working memory of the open web page. We do not set cookies or create Local Storage or Session Storage entries for this purpose. The selection remains the same while navigating within the open main website; reloading, for example with F5, generates a new random selection. The random value is not transmitted to us or third parties and is not used for analytics, advertising or recognition.
When you use Back/Forward, your browser may restore the previously open view. To return from the product designer to the gallery, we also use the existing browser history entry: it remembers the selected piece, displayed image order, filters, number of visible pieces and scroll position. This serves only to return to the previously open view and contains no contact details or design data. Deliberately reloading the page does not reuse this gallery return view.
4. Contact form and email communication
Our general contact form only creates an email draft in your browser. We receive your message only when you send it yourself through your email application; the form does not send it directly through a form server.
Our regular business email accounts are operated through:
ALL-INKL.COM – Neue Medien Münnich
Proprietor: René Münnich
Germany
https://all-inkl.com/datenschutzinformationen/
We process your contact and company details, messages and any accompanying documents to handle your enquiry. The legal basis is Article 6(1)(b) GDPR for pre-contractual measures or contracts with you personally. Other business enquiries, particularly from company contacts, are covered by Article 6(1)(f) GDPR. Our legitimate interest is handling, organising and documenting business communication.
Where a company or another sender supplies details about business contacts, their names, professional contact details, company affiliation and enquiry-related information originate from those sources.
Section 6 describes the additional processing of service emails by Microsoft.
5. Product designer and non-binding product enquiries
You can configure products and submit non-binding enquiries. For this purpose, we process:
- Products, versions, quantities and designs, including necessary configurations, product previews and production information
- Company, name and email address
- Optionally, telephone number, internal reference and personal message
After you check the enquiry overview, only selecting “Send enquiry” transmits the necessary data to our server. Hostinger sends the enquiry from service@langkstv-produktdesigner.de to service@langkstv.de.
You receive an email copy with product previews only if you choose to; this option is unchecked by default. The copy documents your enquiry, contains no advertising and excludes files generated exclusively for our production.
Storage and deletion
Previews and production files are processed to create and deliver the emails; we maintain no additional permanent enquiry archive on our web server. Technical delivery identifiers and protected hashes prevent duplicate deliveries and misuse. Delivery identifiers are cleared after 24 hours, and abuse-prevention identifiers after one hour, on the next successful server-side state access after the respective period expires. Section 7 covers emails and provider-side logs, delivery queues and backups.
The legal basis is Article 6(1)(b) GDPR for pre-contractual measures or contracts with you personally. If you act on behalf of a company, Article 6(1)(f) GDPR applies based on our interest in handling business enquiries. This provision also covers secure technical processing and reliable delivery.
Required information is marked in the form; without it, we cannot handle your enquiry. You have no statutory obligation to use the product designer.
6. Microsoft 365 and AI-assisted service communication
We use Microsoft 365 Business with Exchange Online and Microsoft Copilot. The provider is Microsoft Ireland Operations Limited, Ireland.
All incoming emails to service@langkstv.de, including any attachments, are additionally transmitted to our company-owned Microsoft 365 Business mailbox and stored in Exchange Online. Not all business mailboxes are forwarded; in particular, certain invoice and personal mailboxes are excluded. Access is restricted to authorised persons.
Our staff use Copilot when needed for summaries, searching correspondence, draft replies and following up outstanding matters. This may involve processing contact details, messages, attachments and AI prompts and responses, and storing Copilot interactions. Technical preparation for search and service functions may take place independently of an individual Copilot request. Our staff remain responsible for replies and business decisions; no solely automated decision-making under Article 22 GDPR takes place in the described process.
The legal basis for this additional processing is Article 6(1)(f) GDPR. Our legitimate interest is handling service communication promptly, clearly and economically while reducing staff workload.
Under Microsoft's commitments for commercial Copilot use, prompts, responses and company data retrieved through Microsoft Graph are not used to train the underlying foundation AI models.
Optional web search
Using optional web search may transmit search terms derived from prompts and, where applicable, referenced documents to Microsoft Bing. According to Microsoft, entire emails or documents are not transmitted as search queries. Microsoft acts as an independent controller for these web search queries; Microsoft's privacy statement applies:
https://www.microsoft.com/en-us/privacy/privacystatement
The data protection agreements and Section 7 apply to the other Microsoft 365 business services. Further information:
https://learn.microsoft.com/en-us/microsoft-365/copilot/enterprise-data-protection
Alternative contact
For communication without the Microsoft 365 transmission and Copilot assistance described above, you can use info@langkstv.de. This mailbox is operated exclusively through ALL-INKL/KAS and is not forwarded to Microsoft 365.
7. Recipients, retention and deletion
Access is granted to our staff handling the matter and the hosting, email and IT providers engaged, including authorised subcontractors. Where they act as processors, agreements under Article 28 GDPR apply.
Transfers outside the European Economic Area are subject to the applicable transfer bases, in particular adequacy decisions or EU Standard Contractual Clauses and, where necessary, additional safeguards. Information about transfer safeguards is available through the linked provider documents or on request through our contact address.
Business enquiries
We retain enquiries for as long as necessary to handle them and any subsequent business relationship. Completed enquiries that are no longer needed are deleted unless statutory retention obligations or other lawful reasons require continued storage. The legal basis for statutory retention obligations is Article 6(1)(c) GDPR, and for the necessary establishment, exercise or defence of legal claims, Article 6(1)(f) GDPR.
These criteria also apply to Microsoft 365 copies and related Copilot processing content. As deletion from the original mailbox does not automatically delete them, they are handled separately under our deletion practices.
Technical logs and backups
Access, error and security logs are retained as necessary for secure operation, troubleshooting and abuse prevention, then deleted or cleared under provider retention rules. Backups, recovery data and delivery queues are subject to providers' operational backup and deletion procedures; Microsoft 365 may apply additional technical recovery periods and service-specific retention rules.
8. External links and room view
External services such as Google Maps are only linked, not embedded as an interactive map. A connection to the respective provider is established only when a link is opened.
The optional room view starts only at your request and after any required device permission. On supported Android devices it runs directly in the browser using WebXR; on Apple devices it uses AR Quick Look. Our website does not transmit camera recordings or recordings of your surroundings to our web server. The respective privacy notices apply to the browser, device and AR providers’ own data processing:
https://www.apple.com/legal/privacy/
https://policies.google.com/privacy
9. Your data protection rights
Subject to the statutory conditions, you have the following rights:
- Access under Article 15 GDPR
- Rectification under Article 16 GDPR
- Erasure under Article 17 GDPR
- Restriction of processing under Article 18 GDPR
- Data portability under Article 20 GDPR
Where processing is based on consent, you may withdraw it at any time with future effect; this does not affect the lawfulness of processing before withdrawal.
To exercise your rights, contact service@langkstv.de or info@langkstv.de.
Right to complain
You may complain to a data protection supervisory authority, particularly where you habitually reside or work or where an alleged infringement occurred. One competent authority is the Hessian Commissioner for Data Protection and Freedom of Information:
https://datenschutz.hessen.de/
10. Data security and updates
Our website uses HTTPS/TLS to encrypt data transmission. Appropriate technical and organisational measures protect personal data against unauthorised access, loss and misuse. We update this privacy policy when processing changes materially.