Privacy Policy

KapitalBalance, Ballindamm 27, 20095 Hamburg, Germany ("KapitalBalance", "we", "us" or "our") is the data controller responsible for the processing of your personal data described in this Privacy Policy. We are committed to protecting your privacy and handling your data in a transparent manner in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

1. Data We Collect

1.1 Data you provide to us

• Contact form data: name, email address, telephone number and the content of your message when you contact us through our website forms.
• Correspondence: information contained in emails, letters or phone calls you exchange with us.
• Client data: financial statements, budgets, spending records and related business information that you provide to us within the framework of a consulting engagement.

1.2 Data collected automatically

• Server log data: IP address, date and time of access, requested pages, referring URL, browser type and operating system, collected when you visit our website.
• Cookies and similar technologies: see Section 7 and our Cookies Policy for details.

2. Purposes and Legal Bases for Processing

• Responding to enquiries (Art. 6(1)(b) GDPR): we process your contact details to answer your questions and provide requested quotations.
• Performance of contracts (Art. 6(1)(b) GDPR): we process client data as necessary to deliver our budget allocation and financial planning services.
• Legitimate interests (Art. 6(1)(f) GDPR): we process log data to ensure the security, stability and proper functioning of our website.
• Consent (Art. 6(1)(a) GDPR): we place non-essential cookies and send marketing communications only where you have given your consent. You may withdraw consent at any time.
• Legal obligations (Art. 6(1)(c) GDPR): we retain certain records to comply with German commercial and tax law (e.g. HGB, AO).

3. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this policy. Contact form enquiries are deleted no later than 12 months after the correspondence is concluded, unless a business relationship follows. Contractual and financial records are retained for the statutory retention periods under German law, generally six to ten years. Server logs are stored for a maximum of 30 days.

4. Data Sharing and Recipients

We do not sell your personal data. We share data only with:

• Hosting and IT service providers acting as processors under Article 28 GDPR agreements;
• Professional advisers (e.g. tax consultants, auditors, legal counsel) where necessary;
• Public authorities, where we are legally required to disclose data.

Where service providers are located outside the European Economic Area, transfers are based on EU Standard Contractual Clauses or an adequacy decision of the European Commission.

5. Your Rights

Under the GDPR, you have the following rights:

• Right of access (Art. 15 GDPR) — to obtain information about the data we hold about you;
• Right to rectification (Art. 16 GDPR) — to correct inaccurate data;
• Right to erasure (Art. 17 GDPR) — to request deletion of your data;
• Right to restriction of processing (Art. 18 GDPR);
• Right to data portability (Art. 20 GDPR);
• Right to object (Art. 21 GDPR) — to processing based on legitimate interests, including profiling;
• Right to withdraw consent (Art. 7(3) GDPR) at any time, without affecting prior processing;
• Right to lodge a complaint (Art. 77 GDPR) with a supervisory authority, in particular the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI).

6. Data Security

We implement appropriate technical and organisational measures, including TLS encryption for data in transit, access controls, and internal confidentiality commitments, to protect your personal data against unauthorised access, loss or misuse.

7. Cookies

Our website uses cookies. Essential cookies are required for the website to function and do not require consent. Analytics and marketing cookies are only set with your prior consent via our cookie banner. You can change or withdraw your cookie preferences at any time. For full details, please see our Cookies Policy.

8. Changes to This Policy

We may update this Privacy Policy from time to time to reflect legal or operational changes. The current version is always available on this page. This version was last updated in January 2026.

9. Controller Contact