Privacy
Privacy policy
We keep this short because we collect very little. This policy explains what happens when you visit this website, email us or use our forms.
Who is responsible
Moritz Reiß, Hofmatte 20, 79232 March, Germany. Email: hello@kettlebury.co.nz
No cookies, no tracking
This website sets no cookies and uses no analytics, tracking pixels or advertising tools. It loads no content from other providers: fonts and images are served from our own server.
Server logs
When you open a page, the web server briefly records technical data such as your IP address, the date and time, the page requested and your browser type. We need this to deliver the website and keep it secure (legitimate interest, Art. 6(1)(f) GDPR). The logs are kept only for a short period and then deleted, and we do not use them to identify visitors.
Hosting
This website is hosted by Hetzner Online GmbH in Germany. Hetzner processes the server data described above on our behalf under a data processing agreement.
When you email us
If you email us, we use your email address and the information you send only to reply to you and, if you become a client, to work with you. We keep it as long as needed for that purpose and to meet legal record-keeping obligations. The same applies to our contact form: your name, email address and message go to our own server at Hetzner in Germany and, as a copy, to our mailbox.
Preview request form
If you ask for a free preview with our preview request form, we receive your business name, your town or Google Maps link and your email address, and, only if you choose to add them, your phone number, your wishes and photos, plus the time of the request and the version of the consent text you ticked. We do not store your IP address with it. We use these details to check that the address belongs to the business, to build your preview and to email you about it (Art. 6(1)(b) GDPR, because you asked; for the emails your consent, Art. 6(1)(a) GDPR). You get one email confirming the request. The request waits on our server in Germany (Hetzner) only until we fetch it, usually less than a day; after that it is kept in our customer database (Supabase) until the preview is finished with, and for at most 6 months if you do not become a client. The record of where we confirmed your address is kept for 3 years. Your preview is hosted by BunnyWay d.o.o. (Slovenia, EU); if you pay, Stripe processes the payment. You can withdraw at any time with a short email or by replying “stop”: we then delete your details and put your address on our do-not-contact list. We give you this notice when we collect the information, as information privacy principle 3 of the Privacy Act 2020 requires.
Uploading photos
Purpose: if you upload photos with the preview request form, we use them only for your website: first in your preview and, if you order, on the finished site.
Data: the image files themselves, including the information your phone or camera stores in them (for example the time and, if switched on, the place the photo was taken). The files get new names on our server; your original file names are not stored.
Legal basis: Art. 6(1)(b) GDPR (your request). If people can be recognised in a photo, by uploading it you confirm that they agree; without that we do not use the photo.
Recipients: the photos are kept on our server at Hetzner in Germany and on our work computer. To make the changes I use an AI service by Anthropic as a processor; where data goes to the USA, this is based on the EU-US Data Privacy Framework or standard contractual clauses. They become public only as part of your preview or your website.
How long: on the form server only until we fetch the request, usually a few days, then they are deleted there. If you do not order, we delete them together with your request; if you order, they are kept for as long as the contract runs. On request we delete single photos or all of them straight away.
If you do not send photos and we cannot find any of your business online, your preview uses suitable example photos for now; we swap them for yours as soon as you send some.
Photos and logo sent with “Request a change”
Purpose: if you upload photos or your logo with “Request a change”, I use them only to update your preview and, if you order, for your website.
Data: the files themselves, including the information your phone or camera stores in them (for example the time and, if switched on, the place a photo was taken), your notes on the photos, who took them, your confirmation of the rights and your email address. The files get new names; your file names and your IP address are not stored.
Location data: before I use a photo, I save it again without this embedded information and delete the original. Logos sent as PDF or SVG are kept unchanged.
Legal basis: Art. 6(1)(b) GDPR (your request before a possible contract). If people can be recognised, you confirm with the tick box that they agree; otherwise I do not use the photo.
Recipients: the files are kept on my server at Hetzner in Germany and on my work computer. To make the changes I use an AI service by Anthropic as a processor; where data goes to the USA, this is based on the EU-US Data Privacy Framework or standard contractual clauses. A photo becomes public only as part of your preview or website.
How long: on the form server only until I fetch it, then it is deleted there. If you do not order, I delete the files together with the preview; if you order, for as long as the contract runs. On request I delete single files or all of them straight away.
Ordering from your preview
If you order your website from the preview, we use your details to carry out the contract and to invoice you (Art. 6(1)(b) GDPR; for legal record-keeping Art. 6(1)(c) GDPR). Payment is handled by Stripe Payments Europe Ltd., Ireland; you leave our pages for that, and this website itself loads nothing from Stripe. Stripe processes your card details; we only see the last four digits. If you pay with PayPal, PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, processes your PayPal account details as an independent controller. A transfer to Stripe, Inc., USA, is possible (EU standard contractual clauses or the Data Privacy Framework). We create invoices with our own invoicing software (Invoice Ninja, hosted by us). Invoices and accounting records are kept for the periods German law requires (up to 10 years).
Your rights
Under the GDPR you can ask for access to, correction or deletion of your personal information, restrict or object to its processing, and receive it in a portable format. You can also complain to a data protection supervisory authority.
The easiest way is our form “Your privacy rights”. An objection to marketing and a deletion are carried out as soon as you confirm your email address. Email and post still work as well.
Under the New Zealand Privacy Act 2020 you can ask to access and correct personal information we hold about you. If you are not happy with how we handle your request, you can complain to the Office of the Privacy Commissioner.
To use any of these rights, just email hello@kettlebury.co.nz.
The “Your privacy rights” form
Purpose: to handle your request about your rights and to show that we answered it in time.
Data: what you ask for, your email address, your business name, the link to your preview or your postal address (to find your data), your message, and the time of the request and of your confirmation. We do not store your IP address with it.
Legal basis: Art. 6(1)(c) GDPR with Art. 12 and 15–21 GDPR.
Recipients: the form sends to our own server at Hetzner in Germany. We send the confirmation email and our answer from our own mailbox.
How long: requests that are not confirmed are deleted after 7 days. After we have dealt with a request we keep only the date, what you asked for, the steps taken and your email address as an unreadable checksum, for 3 years.
Last updated: 3 November 2026