Data protection status of the public website
The website does not load any analytics or advertising services. The dated rating status is locally integrated; only the conscious link click opens Google.
Deliver pages, detect errors and ward off attacks.
Process the enquiry you explicitly submitted and agree on the requested next steps.
Securely transmit and reply to an explicitly sent message.
Show a manually confirmed rating status and lead to the Google profile with a conscious click.
No analysis profiles on the public website.
No behavioral advertising and no retargeting.
Checked on 10.08.2026 · Contact: Show email address
Apps and Games
The FruttiMergi mobile game app has its own privacy policy with information on optional Rewarded Ads, Google Play Billing and locally stored app settings.
Privacy
Information about data protection on kankaiworks.de and OPERIO self-processing.
Status: 13. August 2026
This version is updated to the currently occupied OPERIO status including multi-device recovery, 30+90 day lifecycle, erasure/backup reconciliation, provider change and ASSISTO provider boundary.
The person responsible shall be:
Steffen Übelein
Sole proprietorship, acting under: KAN KAI WORKS
Nürnberger Straße 14
96114 Hirschaid
Germany
E-mail: Show email address
Contact form: https://kankaiworks.de/kontakt/
Data protection requests can be addressed to the mentioned e-mail address.
KAN KAI WORKS is managed as a one-person sole proprietorship. A data protection officer is not appointed. From the currently confirmed organizational and processing facts, no reason for designation according to Art. 37 GDPR or § 38 BDSG has been established. If personnel, core activity or processing changes significantly, the obligation to designate is re-examined.
This privacy policy applies to the publicly accessible website kankaiworks.de, contact and test requests, the own contract and user management of KAN KAI WORKS, payment processing as well as the own processing of access, security and recovery data for OPERIO.
Insofar as customers use OPERIO to process personal data of their own employees, customers, business partners or other persons, KAN KAI WORKS regularly processes these data as a processor. For this processing, the data processing agreement in accordance with Art. 28 GDPR also applies.
Personal data are in particular processed for:
Depending on the processing, we rely in particular on Art. 6 para 1 lit. b DSGVO, Art. 6 para 1 lit. c GDPR and Art. 6 para 1 lit. f GDPR. In the case of processing based on legitimate interests, these lie in particular in a secure, functional and abuse-resistant operation as well as in the appropriate processing of business communication.
The public website at the goneo Internet GmbH, Dresdener Straße 18, 32423 Minden, Germany.
When called up, technically necessary connection and protocol data can be processed, in particular IP address, time, URL, HTTP status, browser/operating system information, referrer if transmitted as well as error and security information.
For a general contact request, according to the data minimisation principle, only the data required for processing are collected as mandatory information. Mandatory information should be limited to business e-mail address and message, unless the specific request requires further information. Name, company, telephone number and other additional information are in principle voluntary, unless they are expressly indicated in the form as necessary for factual reasons.
The processing takes place at the initiation of the contract on Art. 6 para 1 lit. b GDPR, in the case of other business communication regularly on Art. 6 para 1 lit. f GDPR.
The regular free OPERIO test takes 30 calendar days and does not require payment data. It does not only lead to a paid contract by expiration of time.
The set-up of the test shall regularly require:
Phone number, desired modules, industry, assignment description and comparable additional information are in principle voluntary if they are not required for a specific test scope.
After the expiration of the 30 days, there is no chargeable activation 90-day restricted period. From day 120, the trial tenant, which is not activated for a fee, is intended for automatic deletion, as long as no legal/contractual storage reason, no legal hold and no ongoing export/change of provider call-up period opposes.
The legal basis is Art. 6 para 1 lit. b GDPR; for necessary security and misuse protection processing additionally Art. 6 para 1 lit. f GDPR.
The productive OPERIO application is based on the infrastructure of Hetzner Online GmbH operated. This includes the productive application/database runtime and the storage components required for OPERIO in the current production setup.
The public website, domain/DNS functions and the operational e-mail delivery are in the current structure via the goneo Internet GmbH provided.
During operation, the technical data necessary for provisioning, routing, TLS, security, error analysis and protection against abuse are processed. This may include, in particular, IP addresses, request/time information, technical headers, destination paths, status/error codes and security events.
For the currently operated OPERIO production status, no external AI model provider and no external payment service is configured as active customer data processing.
OPERIO uses passkey/web authentication and device binding procedures for regular product access. In particular, user identification, e-mail address, role/authorization data, device designation, credential identifiers, web authentication/authentication metadata, time stamps, session information, IP/security metadata and revocation and recovery events can be processed.
Private keys of the passkey remain with the authenticator or the passkey infrastructure used by the user. OPERIO does not receive biometric templates; a device PIN or biometric check is performed by the operating system/authenticator.
For the public recovery request, only the deposited e-mail address is sufficient. A tenant identifier, password, SMS code or OTP is not required.
The e-mail proof bound on the server side to exactly one user and client can be used once, is not stored in plain text and is 20 minutes valid. The mere opening of the link does not consume it; only the explicit confirmation starts the restoration.
The confirmation generates a 30 minutes limited recovery right, but not a normal application session. At the same time, the pre-recovery sessions, device bindings and WebAuthn credentials of the affected account will be revoked.
Within the recovery window, several new devices can be released individually. Each device performs its own WebAuthn registration and receives its own device binding. The device that started the restore, the device on which the email is confirmed and the target devices may differ from each other. Old devices are not automatically released again.
The legal basis is Art. 6 para 1 lit. b GDPR as well as for security and abuse protection Art. 6 para 1 lit. f GDPR.
Your manually selected language (German or English) is stored under “kkw-language-v1” in this browser’s local storage. This preserves your choice for future visits. You can change it using the language switch or reset it by clearing this website’s data in your browser. Without a saved choice, the website uses your browser’s preferred languages. Your language selection is not sent to a translation service.
No analytics or advertising cookies, no retargeting and no behavioral tracking are used on the public website.
Technically necessary cookies or local storage mechanisms may only be used if they are absolutely necessary for a digital service expressly desired by the user, in particular for authentication, session security, device binding, WebAuthn, CSRF protection, form protection, offline functionality, expressly desired draft storage or technical compatibility states.
As far as § 25 TDDDG is applicable, a necessary consent will be obtained for storage or reading that is not absolutely necessary. As long as only absolutely necessary storages are used, no consent banner is displayed only for its own sake.
Local offline data are separated for clients and users. Passwords, API keys, long-lasting authentication secrets and recovery tokens must not be stored as regular plaintext data in browser storage. After logout, revocation or loss of access, local data must be removed or disabled in such a way that they do not allow unauthorized access.
No Google Analytics, Meta-Pixel, Hotjar or similar personal analytics/advertising tracking services are used. A later introduction of unnecessary analytics or marketing technologies requires a new data protection and consent decision and must not be carried out silently.
In the current OPERIO production status Stripe not actively configured and there is currently no payment processing of OPERIO customer data via Stripe.
For paid contracts, KAN KAI WORKS processes the data necessary for contract, price, invoice and payment status on the basis of Art. 6 para 1 lit. b and c GDPR.
If an external payment service is used in the future, the specific provider will be identified in the order / payment channel before transmission and this privacy policy will be updated accordingly before productive use. Where possible, complete payment instrument data should be processed directly by the respective payment service and not by OPERIO itself.
In the current OPERIO production status no OpenAI or other external AI model provider configured. There is currently no customer-related transfer of OPERIO content to OpenAI.
The current ASSISTO logic works locally/deterministically and provides supporting hints or classifications that can be checked by a person. It does not generate an autonomous legally binding, personnel, payment or security decision.
If an external AI function is later activated productively, a new technical and data protection check takes place before the first customer data transmission. In particular, the provider, role, processing purpose, data categories, processing locations, transfer mechanisms, storage/training and, if applicable, subcontractors are then transparently documented.
Current relevant external service providers/recipients are in particular:
Further recipients receive personal data only insofar as this is necessary for the performance of the contract, due to a legal obligation or on another legal basis. Stripe and OpenAI are not configured as active customer data processors in the current OPERIO production status.
For the currently used OPERIO core suppliers Hetzner and goneo, no customer-related third-country processing route is planned in the current production setup.
Should a service with processing or access be used outside the EEA in the future, this will only be done in accordance with Art. 44 ff. GDPR and after prior update of the data protection/AVV information concerned. Depending on the case, in particular adequacy decisions or suitable guarantees such as EU standard contractual clauses are considered.
In principle, personal data will only be processed as long as this is necessary for the respective purpose and does not preclude any statutory, contractual or legally permissible storage.
The main current rules are:
Depending on the category, commercial and tax documents may in particular last 10 years (e.g. B. books/annual financial statements), 8 years (accounting documents) or 6 years (trade/business letters and other relevant documents). Relevant is the applicable legal category and deadline.
The storage of individual invoice, booking or contract proof does not justify the permanent storage of the full customer tenant.
Insofar as the legal requirements exist, there are in particular rights to access, correction, deletion, restriction, data portability and objection. A given consent can be revoked with effect for the future.
Requests are addressed to: Show email address.
Insofar as processing is based on Art. 6 para 1 lit. f GDPR, objections may be filed for reasons arising from the special situation of the person concerned. The legal exceptions remain unaffected.
Data subjects may complain to a data protection supervisory authority. For the headquarters of KAN KAI WORKS, the Bavarian State Office for Data Protection Supervision (BayLDA) relevant.
KAN KAI WORKS shall take appropriate technical and organisational measures. Publicly or contractually, only those concrete security measures are presented as active that are actually verified in productive operation. The measures shall be reviewed at least annually and after significant safety/architecture changes; their effectiveness shall be tested on a risk-based basis.
This privacy policy is adapted if actual processing, service providers or legal requirements change significantly. Relevant is the published version; contractually included document versions remain unaffected.
