Information on the processing of your personal data under the DSGVO (GDPR) at Kontor im Schwarzwald GmbH (KiS).
We, Kontor im Schwarzwald GmbH (hereinafter “KiS”, “we” or “us”), take the protection of your personal data very seriously. In accordance with Art. 13 and 14 DSGVO, this privacy policy informs you about which data we process when you use our website, in the course of our brokerage activities and via our social media profiles.
Kontor im Schwarzwald GmbH
Im Hinterdorf 10
79585 Steinen
Phone: +49 (0) 7627 / 8707
E-mail: online@kiscon.de
We are not legally obliged to appoint a data protection officer (§ 38 Abs. 1 BDSG): in our company, no more than one person is permanently engaged in the automated processing of personal data. Our activities focus on property insurance; we only occasionally arrange health and life insurance (mainly term life), so there is no large-scale processing of special categories of data as a core activity within the meaning of Art. 37 Abs. 1 lit. c DSGVO. If you have any questions about data protection, please use the contact details given above.
Personal data is any information relating to an identified or identifiable natural person (Art. 4 Nr. 1 DSGVO). We process this data exclusively within the framework of the statutory provisions, in particular the DSGVO and the Bundesdatenschutzgesetz (BDSG, Federal Data Protection Act).
Our website is operated by an external service provider (host) acting for us as a processor pursuant to Art. 28 DSGVO. The host processes the data arising when the website is visited exclusively on our instructions in order to provide, maintain and secure the service.
Hosting provider: dogado GmbH, Antonio-Segni-Straße 11, 44263 Dortmund, Germany (servers located exclusively in Germany). A data processing agreement pursuant to Art. 28 DSGVO is in place with dogado GmbH. The host also provides the storage space, the database and e-mail services and the sending of the messages generated via the contact form. Legal basis: Art. 6 Abs. 1 lit. f DSGVO (legitimate interest in the secure and efficient operation of our online service). Privacy information: dogado.de/datenschutz.
Each time our website is accessed, information is automatically collected and stored in so-called server log files. This is technically necessary and takes place regardless of consent. The following in particular is recorded:
Purpose: ensuring a smooth connection and convenient use of the website, evaluating system security and stability, and defending against and investigating attacks.
Legal basis: Art. 6 Abs. 1 lit. f DSGVO (legitimate interest in the technically error-free presentation and security of our website).
Storage period: The log files are generally deleted or anonymised after 7 days. Longer storage only takes place insofar as this is necessary to investigate a specific security incident; the data concerned is then retained until the incident has been fully resolved.
This data is not combined with other data sources or evaluated for marketing purposes.
As part of our brokerage activities, we determine your individual insurance needs in order to be able to advise you comprehensively.
Art. 6 Abs. 1 lit. b DSGVO (initiation/performance of the brokerage contract). For health data, additionally Art. 6 Abs. 1 lit. a in conjunction with Art. 9 Abs. 2 lit. a DSGVO (explicit consent).
Until the end of the brokerage mandate or user relationship, thereafter in accordance with statutory retention periods (in particular § 257 HGB, § 147 AO – up to 10 years).
With our pension check, we determine your individual retirement provision needs in order to advise you on the options for statutory, occupational and private pension provision.
Art. 6 Abs. 1 lit. b DSGVO. For health data, additionally Art. 6 Abs. 1 lit. a in conjunction with Art. 9 Abs. 2 lit. a DSGVO.
Until the end of the brokerage mandate, thereafter statutory retention periods.
The core of our activity is arranging suitable insurance. For this purpose, we process your data in order to conclude contracts with insurers.
Broker pools (based in Germany) for efficient connection to insurers, as well as the respective insurers. Data is only transferred to third countries if this is necessary for the specific insurance; you will be informed of this in advance.
Art. 6 Abs. 1 lit. b DSGVO; for health data, additionally Art. 6 Abs. 1 lit. a in conjunction with Art. 9 Abs. 2 lit. a DSGVO.
Until the end of the brokerage mandate, thereafter statutory retention periods.
If you contact us via the contact form, by e-mail or by phone, we process your contact details and the content of the communication in order to answer your enquiry and advise you as part of our brokerage activities.
Legal basis: Art. 6 Abs. 1 lit. b DSGVO (initiation/performance of a contract) or Art. 6 Abs. 1 lit. f DSGVO (legitimate interest in answering your enquiry).
Storage period: Until your matter has been fully dealt with or the brokerage mandate has ended; thereafter statutory retention periods.
Spam protection in the contact form: To protect against automated mass submissions (spam), we use technical safeguards. Among other things, the time taken to submit the form is evaluated and your IP address is stored on the server in hashed (non-reversible) form in order to limit the number of submissions per sender (rate limit). In addition, the IP address is logged in the notification e-mail sent to us so that misuse can be traced. Legal basis: Art. 6 Abs. 1 lit. f DSGVO (legitimate interest in preventing spam and misuse). Storage period: The hashed rate-limit entries are automatically deleted after one hour at the latest.
Optionally, you can contact us via WhatsApp Business (WhatsApp Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland). WhatsApp transfers data to WhatsApp LLC and Meta Platforms Inc. (1601 Willow Road, Menlo Park, California 94025, USA) and, where applicable, to other sub-processors in third countries.
Legal basis: Art. 6 Abs. 1 lit. a DSGVO (consent). Transfers to the USA take place on the basis of the EU-US Data Privacy Framework and/or standard contractual clauses (Art. 46 Abs. 2 lit. c DSGVO).
As your insurance broker, we provide you with ongoing support in all insurance matters. For this, we use CRM and administration systems (e.g. Salesforce platforms of our broker pools) in order to manage your needs efficiently.
Art. 6 Abs. 1 lit. b DSGVO; for health data, additionally Art. 6 Abs. 1 lit. a in conjunction with Art. 9 Abs. 2 lit. a DSGVO.
On our website, we embed comparison and tariff calculators from various providers via iFrames. These serve to give you an overview of the market and to enable the arrangement of suitable contracts.
insurances-online.levelnine.biz, used among others for Süddeutsche Krankenversicherung a. G. (SDK). When the calculator is accessed, our own intermediary and contact details (intermediary number, company address) are transmitted in addition to your entries, so that the advice can be attributed to us. Privacy information: levelnine.biz/datenschutz.All embedded calculators are only loaded after your explicit consent (Art. 6 Abs. 1 lit. a DSGVO, § 25 Abs. 1 TDDDG). Until then, no connection is established with the respective provider and no IP address is transmitted. You give your consent via the category “Comparison calculators & external content” in the cookie banner or directly via the button in the respective placeholder; it can be withdrawn at any time via the cookie settings. For the subsequent processing of your entries, Art. 6 Abs. 1 lit. b DSGVO (initiation of a contract) additionally applies as soon as you actively start a calculation.
As long as necessary for the respective processing purpose; thereafter deletion or anonymisation.
If you subscribe to our newsletter, we process your e-mail address, the time of registration and the IP address used for registration (double opt-in procedure).
Processor: digidor GmbH, Teltower Damm 19E, 14169 Berlin (processing in Germany).
Legal basis: Art. 6 Abs. 1 lit. a DSGVO (consent) or Art. 6 Abs. 1 lit. b DSGVO within the framework of existing brokerage mandates.
Withdrawal: You can unsubscribe from the newsletter at any time via the unsubscribe link in every newsletter or by notifying online@kiscon.de. To ensure that unsubscribed recipients do not receive any further e-mails, we may keep a block list (“blacklist”).
On your first visit to our website, you are shown a cookie banner in which you can set your cookie preferences. You can withdraw any consent given at any time with effect for the future (Art. 7 Abs. 3 DSGVO) by changing your settings or contacting us by e-mail.
These cookies are required to provide the basic functions of the website and cannot be deactivated. Legal basis: § 25 Abs. 2 Nr. 2 TDDDG in conjunction with Art. 6 Abs. 1 lit. f DSGVO.
Via the cookie banner, you can additionally allow external content to be loaded (categories “YouTube”, “Synthesia”, “Comparison calculators & external content” incl. Google Maps, “Statistics” and “Marketing”). Only after your consent are cookies or comparable technologies of the respective providers set. The individual cookies with their name, purpose, storage period and provider are listed per category in the cookie banner under “Show cookie details” and can be viewed at any time via the cookie settings. Legal basis: Art. 6 Abs. 1 lit. a DSGVO and § 25 Abs. 1 TDDDG (consent), which can be withdrawn at any time with effect for the future.
This website uses Google Tag Manager (container ID GTM-M3PJ8F3P) and Google Analytics 4 (measurement ID G-SJEX5TLDMK). The Tag Manager itself does not set any cookies; it serves as a technical tool to load further tags – in particular Google Analytics – only after your explicit consent.
Both services are only activated if you consent to the category “Statistics (Google Analytics 4)” or “Marketing (Google Ads)” in the cookie banner. We use Google Consent Mode: it transmits your choice to Google so that Google services only use data within the scope of your consent. Without your consent, no Google scripts are loaded, no cookies are set and no data is transmitted to Google. If you withdraw your consent, the scripts are removed and any Analytics cookies already set (_ga, _gid, _gat, _ga_*) are deleted.
Google Analytics 4 uses cookies or comparable identifiers to evaluate the use of the website. The data collected includes your IP address (Google Analytics 4 does not store complete IP addresses), browser type, device type, referrer URL, pages visited, time spent and interactions. This data is transferred to servers of Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). A transfer to the USA cannot be ruled out; for this, Google relies on standard contractual clauses and the EU-US Data Privacy Framework.
The purpose of the processing is the statistical analysis of user behaviour in order to optimise our website. Legal basis: Art. 6 Abs. 1 lit. a DSGVO and § 25 Abs. 1 TDDDG (consent), which you can withdraw at any time with effect for the future via the cookie settings.
Further information can be found in Google's privacy information: policies.google.com/privacy, support.google.com/analytics and support.google.com/tagmanager.
Apart from Google Tag Manager, Google Analytics 4 and Google Ads (see the following section), we do not use any other analytics, statistics, tracking or marketing services. In particular, no Meta Pixel, no X conversion tracking and no comparable services of other providers are embedded on this website.
We place ads via Google Ads and have linked our Google Analytics 4 account, our YouTube channel and our Google Business Profile to Google Ads. The provider is Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).
Purpose: We want to recognise whether visitors reached our website via one of our ads and, for example, submitted a contact request there (conversion measurement). We can also show ads again on Google services and YouTube to people who have visited our website (remarketing). We do not use pages with a health connection (e.g. occupational disability, private or Swiss health insurance) or entries in calculators and forms for this purpose.
Data processed: online identifiers (cookie IDs, e.g. _gcl_au), the ad's click ID (GCLID), pages visited, time, device and browser information and your IP address. If you are logged into your Google account, Google may associate the data with your account.
Legal basis: your consent under Art. 6 Abs. 1 lit. a DSGVO and § 25 Abs. 1 TDDDG via the category “Marketing (Google Ads)” in our cookie banner. Without this consent, no advertising cookies are set and no data is transmitted to Google for advertising purposes. You can withdraw your consent at any time with effect for the future via the cookie settings.
Responsibility: For conversion measurement and remarketing, Google is an independent controller alongside us (Google Ads Controller-Controller Data Protection Terms, business.safety.google/adscontrollerterms).
Third-country transfer: A transfer to the USA is possible. Google LLC is certified under the EU-US Data Privacy Framework; standard contractual clauses also apply.
Storage period: conversion cookies up to 90 days; remarketing lists a maximum of 540 days.
Further information: policies.google.com/privacy and policies.google.com/technologies/ads. You can also switch off personalised advertising at adssettings.google.com.
The fonts used on this website (Inter, Quicksand) are delivered exclusively from our own server. There is no connection to Google Fonts or other external font providers; no data – in particular no IP addresses – is transferred to third parties for this purpose.
We maintain publicly accessible profiles on social networks in order to communicate with customers and prospective customers and to provide information about our services. When you visit these profiles, the privacy policies and terms of use of the respective provider also apply. We only process your data there insofar as you send us messages, comment on or rate our posts or follow our profiles.
The legal basis is Art. 6 Abs. 1 lit. f DSGVO (legitimate interest in up-to-date public presentation and customer communication) and – in the case of initiation of a contract – Art. 6 Abs. 1 lit. b DSGVO. In some cases, there is joint controllership with the platform operators pursuant to Art. 26 DSGVO; the corresponding agreements can be found on the providers' websites.
Provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (parent: Google LLC, USA). Data processed: profile data, reviews, comments, interaction data, IP address, device information. Privacy information: policies.google.com/privacy.
We have linked our YouTube channel and our Google Business Profile to our Google Ads account. This allows Google to use interactions with our channel (e.g. videos watched, subscriptions) to measure success and to build audiences for our ads. This processing takes place on Google's platforms.
Provider: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (parent: Meta Platforms Inc., USA). There is joint controllership for Insights data pursuant to Art. 26 DSGVO. Data processed: profile data, interactions, reach and Insights data, IP address. Profiles concerned: @makler.kiscon.de and @besser.versichert.kis. Privacy information: privacycenter.instagram.com/policy. Agreement pursuant to Art. 26 DSGVO: facebook.com/legal/terms/page_controller_addendum.
Provider: Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland (parent: X Corp., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA). Data processed: profile data, tweets/posts, interaction data, reach analyses, IP address. Privacy information: twitter.com/de/privacy.
We do not have full influence over the data processing carried out by the platform operators. As far as possible, we have configured the respective profiles in a privacy-friendly way. Data transfers to third countries (in particular the USA) involve risks (including access by security authorities without effective legal remedies). The transfer takes place on the basis of the EU-US Data Privacy Framework and/or standard contractual clauses.
You can assert your rights against the platform operators (access, rectification, erasure, etc.) most effectively directly with the respective provider, as only they have access to all the data. Of course, you can also contact us at any time – we will then forward your request.
On individual pages (in particular “About us”), we embed videos via the Synthesia service. These videos are only loaded after you have actively consented (two-click solution via our cookie banner or the placeholder on the respective video).
On the “Unternehmen” (company) page, we embed a map from the Google Maps service to show you our location and make it easier to find us. The map is only loaded after you have actively consented (two-click solution via our cookie banner or the placeholder on the map). No connection to Google is established before your consent.
We operate a technical interface (Model Context Protocol, MCP) through which AI assistants such as ChatGPT or Claude can retrieve publicly accessible content from this website at their users' request (site search, withdrawal links, contact details). This interface is not addressed during a normal visit to kiscon.de – no connection whatsoever to this interface takes place.
In the course of our activities, we use carefully selected service providers as processors (Art. 28 DSGVO), including for hosting (see section “Hosting and server log files”), operation of the AI interface (see section “AI interface (MCP server)”), IT maintenance, CRM, e-mail dispatch and accounting. Data is only transmitted to insurers and broker pools insofar as this is necessary for the initiation or performance of a contract.
Insofar as data is transferred to third countries (in particular the USA), this takes place on the basis of adequacy decisions (e.g. EU-US Data Privacy Framework, Art. 45 DSGVO) or appropriate safeguards such as EU standard contractual clauses (Art. 46 Abs. 2 lit. c DSGVO).
We only store personal data for as long as is necessary for the respective purposes or as required by statutory retention periods (in particular § 257 HGB, § 147 AO – up to 10 years; § 14 Abs. 1 S. 2 GwG – 5 years).
You have the right at any time to:
Please send requests to online@kiscon.de.
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data carried out on the basis of Art. 6 Abs. 1 lit. e or f DSGVO. In the case of direct marketing, you can object at any time without giving reasons.
Without prejudice to any other legal remedies, you have the right to lodge a complaint with a data protection supervisory authority, in particular the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information), Lautenschlagerstraße 20, 70173 Stuttgart, www.baden-wuerttemberg.datenschutz.de.
This privacy policy is currently valid. Changes in legal or regulatory requirements or adjustments to our services may make it necessary to update this privacy policy. The current version can be accessed on this page at any time.
As of: October 2026
This page is a translation of our German website. The German version is authoritative: in the event of any discrepancies or ambiguities, only the German version is legally binding, not the translation. We offer advice in German or English. You will receive contracts, insurance terms and documents in German.