Privacy Policy

1. Controller

The controller responsible for processing your personal data under the General Data Protection Regulation (GDPR) is:

2. What data do we collect ourselves?

Dr. Kalliwoda Research GmbH does not place its own tracking or analytics cookies on this website and does not run any first-party analytics tools (no Google Analytics, Matomo, Plausible, or similar).

We only process personal data that you actively provide to us, namely:

• data submitted through the newsletter subscription form (see the separate newsletter privacy policy for details);
• data submitted when creating a user account for our research library (see section 8);
• content of any emails or messages you send to us;
• technical server logs kept by our hosting provider IONOS for operational and security purposes;
• data processed by Cloudflare Turnstile when you submit a form protected against bot abuse (see section 9).

3. Server logs

Our hosting provider IONOS automatically records standard server log information when you visit the website, including IP address, browser type and version, operating system, referring page, pages accessed, and date/time of access. These logs are used solely for the technical operation and security of the website and are not combined with other personal data.

Legal basis: Article 6(1)(f) GDPR (legitimate interest in operating a secure website).

4. Cookies

This website does not set any first-party tracking cookies. Only strictly necessary technical entries are used:

• if you log in to a user account (see section 8), a session cookie named kw_auth is set to keep you signed in. It contains only a random session identifier — no personal data. It is deleted when you log out or after 4 hours of inactivity.
• if you accept the embedded Google Maps prompt on the Contact page, a single entry kw-maps-consent is stored in your browser's local storage (see section 5). It contains only the value accepted or declined and no personal data.

In addition, when you submit a form protected by Cloudflare Turnstile (see section 9), Cloudflare may set a short-lived technical cookie required to complete the bot check. This cookie is cleared once verification finishes.

5. Embedded Google Maps

The Contact page includes a map provided by Google Maps (a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When you actively consent to loading the map:

• Google receives your IP address, the URL of the page you are visiting, and standard request data (browser/operating system, language preference, etc.);
• Google may set cookies on your device to provide and protect the Maps service;
• Google may process this data in the United States and other countries.

Legal basis: your prior consent under Article 6(1)(a) GDPR. You can withdraw your consent at any time by clearing the kw-maps-consent entry in your browser's local storage.

More information about Google's processing of personal data is available in Google's privacy policy.

6. Other external resources

This website also loads the following resources from third-party content delivery networks for layout and typography purposes. These services do not set cookies on your device but may briefly receive your IP address when their files are requested:

• Bootstrap CSS/JS from cdn.jsdelivr.net;
• Font Awesome icon CSS from cdnjs.cloudflare.com;
• Inter, Sora and Playfair Display fonts from fonts.googleapis.com.

7. Newsletter subscriptions

If you subscribe to our updates, the data you submit is governed by our newsletter privacy policy, which describes the double-opt-in process, what data we store, how long we keep it, and how to unsubscribe.

8. User accounts (research library)

To access certain gated research publications, you may create a user account. During registration and use of your account we process:

• your first name and last name;
• your email address;
• a securely hashed password — we never store or see your plain-text password (hashing algorithm: bcrypt);
• your investor classification (retail or professional), as required for MiFID II research disclosure purposes;
• your confirmation that you have read this Privacy Policy, together with a timestamp;
• timestamps for account creation, email verification, and last login;
• a random email-verification token that expires within 24 hours;
• if requested, a random password-reset token that expires within 30 minutes;
• a counter of failed login attempts (used for temporary lockout after repeated failures).

Purpose: to provide access to gated research documents, to distinguish retail from professional investors as required under MiFID II research disclosure rules, and to protect your account against unauthorised access.

Legal basis: Article 6(1)(b) GDPR (performance of the contract that gives you access to the research library) and Article 6(1)(f) GDPR (legitimate interest in account security).

Transactional emails: we send verification and password-reset emails via the SMTP servers of our hosting provider IONOS (1&1 IONOS SE, Montabaur, Germany).

Retention: account data is retained for as long as your account remains active. You may request deletion at any time by writing to nk@kalliwoda.com. Accounts that remain inactive for a prolonged period may be deleted.

9. Cloudflare Turnstile (bot protection)

Our newsletter subscription, account registration, login, and password-reset forms are protected by Cloudflare Turnstile, a privacy-preserving alternative to traditional CAPTCHAs. When you submit any of these forms, Cloudflare processes:

• your IP address;
• your user agent (browser type and version);
• the URL of the page containing the form;
• interaction signals with the Turnstile widget (mouse movement, timing and similar behavioural signals);
• a short-lived session cookie set by Turnstile only for the duration of the verification.

Cloudflare stores this data for up to 30 days. It is not used to build advertising profiles and is not linked to your activity on other websites.

Legal basis: Article 6(1)(f) GDPR (legitimate interest in preventing spam, brute-force attacks and other abuse of our forms).

Processor and international transfer: Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA) acts as our data processor under a standard Data Processing Addendum. Transfers to the USA are covered by Cloudflare's Standard Contractual Clauses and by Cloudflare's participation in the EU-US Data Privacy Framework.

More information: Cloudflare Privacy Policy.

10. Your rights under GDPR

Subject to the applicable legal requirements, you have the right to:

• request access to your personal data;
• request correction of inaccurate data;
• request deletion of your personal data;
• request restriction of processing;
• receive your personal data in a portable format where applicable;
• withdraw your consent at any time with effect for the future;
• object to processing based on legitimate interest;
• lodge a complaint with a competent data-protection supervisory authority.

To exercise your rights, contact: nk@kalliwoda.com

11. Changes to this Privacy Policy

We may update this privacy policy where necessary to reflect changes to our website, the services we use, or legal requirements. The current version is always available at this URL.