Last updated: 14 September 2026
This Privacy Policy explains how we process personal data when you use K.O.T. and when you contact us.
Controller
The controller responsible for the processing of personal data is:
Holon Puzzle
Tomasz Karczewski
Block C-15, Südstraße 31
47475 Kamp-Lintfort
Germany
Privacy contact: kontakt@holonpuzzle.com
Phone: +49 176 79911047
Hosting and technical data
The website is hosted by Hostinger.
When you access the website, the hosting infrastructure processes technical data required to deliver the website and protect its security. Depending on the configuration, this may include in particular:
- IP address,
- date and time of the request,
- requested address or resource,
- request method and server response code,
- technical information transmitted by the browser or device,
- data required for error diagnosis and infrastructure protection.
The legal basis for this processing is Article 6(1)(f) GDPR. Our legitimate interest is to ensure the secure, stable and proper operation of the website, detect errors and prevent misuse.
Hostinger processes data in connection with the provision of hosting and email services. Additional subprocessors may be involved in the provider's infrastructure. Where personal data is transferred outside the European Economic Area in connection with these services, the transfer mechanisms and appropriate safeguards provided by law are used.
Technical data is retained only for as long as necessary for the security, proper operation and diagnosis of the infrastructure, taking into account the retention rules applied by the provider to the relevant service.
Settings stored on your device
The website may remember settings selected by you, in particular the interface language or the state of certain informational notices.
These records are used only to preserve a selected function or preference. We do not use them for advertising, analytics or user profiling.
Where storing information on a user's device or accessing information already stored there is strictly necessary to provide a function expressly requested by the user, Section 25(2) No. 2 TDDDG applies.
You can remove stored settings by clearing the website data in your browser settings. After deletion, the website may ask you to select a setting again or may display a previously dismissed notice again.
Contact by email, phone, SMS and WhatsApp
If you contact us, we process the data you provide in connection with your message or call. This may include, in particular, your email address, phone number, the name used in correspondence, the content of the message and other information required to handle your request.
The legal basis depends on the nature of the contact:
- Article 6(1)(b) GDPR — where the contact concerns a contract or steps taken at your request before entering into a contract,
- Article 6(1)(f) GDPR — for ordinary communication relating to our activities or the website; our legitimate interest is to answer questions and conduct ongoing correspondence,
- Article 6(1)(c) GDPR — where processing or further retention of specific information is required by law.
Email is handled using services provided by Hostinger.
If you choose WhatsApp as a contact channel, WhatsApp Ireland Limited also participates in the processing in accordance with the rules of that service. WhatsApp uses a global infrastructure, so data may also be processed outside the European Economic Area. If you do not wish to use WhatsApp, you can contact us by email instead.
We retain correspondence for as long as necessary to handle the relevant matter. If a message concerns a contract, billing, a legal obligation or possible claims, the relevant information may be retained for a longer period where required by law or for the applicable limitation periods.
YouTube content
YouTube content on the website is loaded using a two-click model.
Before a video is started, a locally provided placeholder is displayed. The external YouTube player is not loaded automatically. A connection to YouTube is established only after the user selects the button used to load the external content.
Before activation, the user is informed that loading the player will establish a connection to YouTube and may result in Google receiving technical data such as the IP address, information about the browser and device, and information related to playback.
The legal basis for processing associated with loading the external content following the user's informed decision is Article 6(1)(a) GDPR. Where loading the player involves storing information on the user's device or accessing information already stored there, Section 25(1) TDDDG also applies.
Consent to load external content applies to the specific interaction and is not automatically treated as permanent consent for all future visits.
YouTube is a Google service. Google may also process data outside the European Economic Area.
Recipients of personal data
Depending on how the website is used, recipients of personal data or parties involved in its processing may include:
- Hostinger — for hosting, infrastructure and email,
- telecommunications providers,
- WhatsApp Ireland Limited — if you choose WhatsApp as a contact channel,
- Google or YouTube — after the external player is loaded,
- public authorities or other authorised recipients where disclosure is required by law.
We do not sell personal data or disclose it for behavioural advertising.
Transfers outside the EEA
Locating a server in the European Union does not mean that every processing operation performed by external providers takes place exclusively within the EEA.
When using services provided by Hostinger, transfers outside the EEA may occur in connection with additional infrastructure providers. Where required, transfers are safeguarded in accordance with Chapter V GDPR, in particular through an applicable adequacy decision or appropriate standard contractual clauses.
If you contact us via WhatsApp, data may also be processed outside the EEA in accordance with the transfer mechanisms described by that provider.
After YouTube content is loaded, data may also be processed outside the EEA in accordance with Google's privacy and transfer mechanisms.
Retention period
We retain personal data no longer than necessary for the purpose for which it was collected, unless a longer period is required by law or is necessary for the establishment, exercise or defence of legal claims.
Where a fixed deletion date cannot be specified in advance for a particular category of data, the retention period is determined by the purpose of the processing, security requirements, statutory obligations and applicable limitation periods.
Your rights
Subject to the conditions set out in the GDPR, you have in particular the right to:
- access your personal data,
- rectification,
- erasure,
- restriction of processing,
- data portability where the statutory requirements are met.
You can exercise these rights by contacting us at kontakt@holonpuzzle.com.
Right to object
Where we process personal data on the basis of Article 6(1)(f) GDPR, you may object to the processing at any time on grounds relating to your particular situation.
Following an objection, we will no longer process the data for that purpose unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.
Withdrawal of consent
Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
Right to lodge a complaint
You have the right to lodge a complaint with a competent supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement.
The supervisory authority responsible for the controller's place of establishment is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Email: poststelle@ldi.nrw.de
Website: www.ldi.nrw.de
Provision of data
Technical connection data is required to deliver the website.
Information you provide when contacting us is provided voluntarily. However, without the information required to identify and handle your request, we may be unable to respond.