Privacy policy (Datenschutzerklärung)

Last updated: 23 October 2026

In short: this website has no forms, accounts or comments, and the public site sets no cookies. Cloudflare delivers the pages and counts visits for us; the counting script reads some technical information from your browser (section 3). If you email us, your message reaches us through Cloudflare and Google (section 4). Your rights are in sections 7 and 8.

1. Who is responsible

Kermit Capital UG (haftungsbeschränkt)
Urbanstraße 71, 3. Hof, Aufgang links, 1. OG
10967 Berlin
Germany
Email: [email protected]

We have not appointed a data protection officer; at our size the law doesn’t require one (§ 38 BDSG).

2. Hosting and delivery

This website is static: every visitor gets the same pages. It is hosted on Cloudflare Pages and delivered through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.

When your browser requests a page, Cloudflare processes:

your IP address,
the date and time of the request,
the address of the page, your browser’s user agent and the referring page (referrer),
other technical data the request carries.

Cloudflare does this on our behalf as our processor (Art. 28 GDPR), under its Data Processing Addendum, which is part of our contract with Cloudflare. Cloudflare keeps this data only as long as it needs it for delivery and security, and publishes no fixed period. We keep no access logs ourselves. Cloudflare also uses data from its network for the security of that network and for aggregated statistics; see Cloudflare’s privacy policy.

Purpose and legal basis: delivering the website and keeping it secure and available, Art. 6(1)(f) GDPR. That is our legitimate interest.

3. Visitor statistics (Cloudflare Web Analytics)

To see how many people visit and which pages they read, we use Cloudflare Web Analytics, a service of Cloudflare, Inc. Every page loads a small script from static.cloudflareinsights.com; like any request, this tells Cloudflare your IP address. The script then reads the following from your browser and sends it to cloudflareinsights.com:

the address of the page (without query strings) and the referring page,
your browser’s user agent and, through the browser’s client hints, the version of your operating system,
how long the page took to load and render, the Core Web Vitals (including the CSS selector of the element you interacted with), and how much memory the page used.

The script sets no cookies and stores nothing in your browser. It uses a random identifier for each page view. Cloudflare states that Web Analytics doesn’t fingerprint visitors and doesn’t track them across websites. We only ever see totals, such as page views, referring sites, countries, browsers and loading times, never individual visitors.

Cloudflare keeps the full data for 7 days, then reduces it to an aggregated sample of about 10 % for long-term storage. We can view the statistics for the past six months.

Purpose and legal basis: knowing whether and how the website is used and how fast it loads, without cookies and without profiles of individual visitors, Art. 6(1)(f) GDPR. Cloudflare acts as our processor, as in section 2.

You can object at any time (section 8). You can also stop the script by blocking static.cloudflareinsights.com in your browser or with a content blocker; the website works the same without it.

4. Emailing us

If you write to [email protected], your email passes through two services:

Cloudflare Email Routing (Cloudflare, Inc.) receives it, checks it for spam and authenticity, and forwards it. Cloudflare doesn’t store the content, but logs the sender, recipient, subject, message ID, the delivery result and the authentication results for 31 days. Cloudflare acts as our processor.
Gmail then delivers it to our mailbox. Gmail is run by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use an ordinary Gmail account, for which Google offers no data processing agreement. Google therefore processes the email as its own controller, under its own terms and privacy policy, and is not bound by our instructions. Google may transfer data to Google LLC in the USA.

We process what you send us, usually your name, your email address, your message and any attachments, in order to answer you.

Legal basis: Art. 6(1)(b) GDPR where your message concerns a contract with us or steps before one; otherwise Art. 6(1)(f) GDPR, our legitimate interest being to answer the messages we receive.

We delete an enquiry once it is resolved, at the latest 12 months after the last message, and empty the trash as well. Emails that count as business letters we keep for 6 years, and emails that are accounting records for 8 years, counted from the end of the calendar year (§ 257 HGB, § 147 AO).

Email travels between mail servers encrypted (TLS) where both sides support it, but it isn’t end-to-end encrypted: Cloudflare in transit and Google in the mailbox handle the content in readable form. Please don’t send confidential information by email; you can call us instead (the number is in the Impressum).

5. Protected preview pages

We show drafts of this website on subdomains of kermitcap.pages.dev, such as preview.kermitcap.pages.dev. Cloudflare Access, part of Cloudflare Zero Trust (Cloudflare, Inc.), protects them with a login page: you enter your email address and receive a one-time code, and only addresses we have approved get in. Cloudflare logs every login attempt (the email address entered, IP address, country, time and result) and keeps that log for 24 hours. After login, Cloudflare sets cookies (CF_Authorization, CF_Session, CF_AppSession, CF_Device) that keep you signed in for up to 24 hours. They are strictly necessary for the protected pages you asked for (§ 25 Abs. 2 Nr. 2 TDDDG).

Purpose and legal basis: keeping unpublished drafts private, Art. 6(1)(f) GDPR. The public website uses none of this.

6. Recipients and transfers outside the EU

Cloudflare, Inc. (USA), our processor for hosting, statistics, email routing and the preview login. Its sub-processors are listed at cloudflare.com/gdpr/subprocessors. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework, so transfers to it rest on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR). Where that doesn’t apply, the EU standard contractual clauses in Cloudflare’s Data Processing Addendum do (Art. 46(2)(c) GDPR).
Google Ireland Limited (Ireland), for email, as its own controller (section 4). Google may transfer data to Google LLC in the USA and is responsible for the safeguards of that transfer.

We pass personal data to no one else unless the law obliges us to.

7. Your rights

You have the right to:

find out what data we hold about you (Art. 15 GDPR),
have it corrected (Art. 16 GDPR),
have it erased (Art. 17 GDPR),
have its processing restricted (Art. 18 GDPR),
receive the data you gave us in a structured, machine-readable format (Art. 20 GDPR).

To use these rights, write to [email protected] or to our postal address.

You can also complain to a data protection authority (Art. 77 GDPR), in particular in the EU country where you live or work. The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, Germany, phone +49 30 13889-0, [email protected].

Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you can object at any time, on grounds relating to your particular situation. We then stop processing it, unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. A short email to [email protected] is enough.

9. Other information

You don’t have to give us any personal data to read this website. If you write to us, we need your email address to reply. We make no automated decisions about you and do no profiling (Art. 22 GDPR).

We update this policy when the website or the law changes. The current version is always on this page, and the date at the top shows the last change.