Privacy Policy

Last updated: 12 August 2026

At Regulatory Strategy Consulting Kunz ("we", "our", "us"), we are committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, process, and protect personal information when you visit our website, contact us, or use our services.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable German data protection laws.

1. Data Controller

Regulatory Strategy Consulting Kunz
Dr. Erika Kunz
Rannenbergring 67
63755 Alzenau
Germany
Email: contact@rsc-kunz.de
Website: rsc-kunz.de

2. Personal Data We Collect

We collect and process the following categories of personal data:

Information You Provide Directly

• Name
• Company name
• Job title
• Email address
• Telephone number
• Correspondence and inquiry details
• Any information voluntarily provided through contact forms, emails, or meetings

Information Collected Automatically

When you visit our website, the following data is processed by our hosting and content delivery providers in order to deliver and secure the website. Details of these providers, and of the data they process for their own purposes, are set out in section 7.

• IP address
• Browser type and version
• Device information
• Date and time of access
• Pages visited
• Referring website URLs

3. Purpose of Processing

We process personal data for the following purposes:

• Receiving and responding to enquiries submitted through the contact form or by email
• Performing consulting engagements and managing the client relationship
• Delivering, operating and securing the website
• Providing embedded video content where you have given your consent
• Complying with statutory retention, accounting and tax obligations

4. Legal Basis for Processing

We process personal data on the following legal grounds under Article 6 GDPR:

Responding to enquiries submitted through the contact form or by email

Art. 6(1)(b) GDPR where the enquiry concerns a possible engagement, otherwise Art. 6(1)(f) GDPR. Our legitimate interest is receiving and answering business enquiries.

Performing consulting engagements and managing the client relationship

Art. 6(1)(b) GDPR where you are our client or act for our client.

Delivering, operating and securing the website

Art. 6(1)(f) GDPR. Our legitimate interest is the stable and secure provision of the website and the prevention of automated misuse.

Loading an embedded YouTube video after you click

Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

Retaining business correspondence and contractual documentation

Art. 6(1)(c) GDPR in conjunction with Section 257 HGB and Section 147 AO.

5. Contact Forms and Inquiries

When you submit information through our website contact form, we use your personal data solely to:

• Respond to your inquiry
• Evaluate potential business opportunities
• Communicate regarding requested services

We will not use your information for direct marketing purposes without your consent.

The mandatory fields are your name, your email address and your message. Providing this information is neither required by law nor by contract, but without it we cannot respond to your enquiry. Please do not include confidential client information or special categories of personal data in the form; use encrypted email or a call instead.

Our acknowledgement email and our reply do not contain tracking pixels. We do not measure whether an email is opened or whether links in it are clicked.

6. Cookies and Website Technologies

This website does not use cookies for analytics, advertising or cross-site tracking. Only technically necessary cookies are set by our content delivery provider in order to secure the website and to protect it against automated misuse. These are stored on the basis of Section 25(2) no. 2 TDDDG and do not require consent.

No tracking or analytics

This website does not use analytics services, advertising cookies, or cross-site tracking technologies.

Fonts

All typefaces used on this website are hosted on our own infrastructure. No font data is requested from third-party services such as Google Fonts, and no data is transmitted to such providers when you visit this website.

YouTube videos (two-click consent)

Some pages present video content hosted on YouTube, a service of Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. These videos are not loaded automatically. Instead, a placeholder is displayed, and the video is only requested from YouTube after you actively click "Load video".

Until you click, no connection to YouTube or Google is established and no data is transmitted. Once you click, your IP address, browser information and the address of the page you are visiting are transmitted to Google, which may process this data outside the European Economic Area on the basis of Standard Contractual Clauses. We use the extended data protection mode (youtube-nocookie.com), so YouTube does not set tracking cookies unless you start playback.

The legal basis for this transmission is your consent, given through the click (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). You can withdraw your consent at any time with effect for the future by reloading the page, which restores the placeholder. Further information is available in Google's privacy policy at policies.google.com/privacy.

Whitepaper downloads

Our whitepapers can be downloaded freely and without registration. We do not ask for an email address, we do not operate a download gate, and we do not create a personal profile of who downloads which publication.

7. Data Sharing

We do not sell personal data.

Processors acting on our instructions (Art. 28 GDPR)

• Website hosting and application platform: Lovable Labs Incorporated, 1111b South Governors Avenue, Dover, DE 19904, USA. Lovable engages its own sub-processors, including Cloudflare, Inc. for edge routing and DNS. The current list is published at https://trust.lovable.dev/subprocessors.
• Email delivery: Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA, used to transmit contact form enquiries and the automated acknowledgement email. The current sub-processor list is published at https://resend.com/legal/subprocessors.
• Email mailbox hosting: STRATO AG, Germany, which hosts the contact@rsc-kunz.de mailbox receiving your enquiry.

Data processing agreements pursuant to Art. 28 GDPR are in place with each of these providers.

Recipients acting as independent controllers

• Lovable processes server log data - including your IP address, approximate location, browser type and version, the pages you access, timestamps and session or device identifiers - as an independent controller for security and platform improvement purposes. This processing is expressly excluded from our data processing agreement and is governed by Lovable’s own privacy policy at https://lovable.dev/privacy. The legal basis for our disclosure is Art. 6(1)(f) GDPR.
• Resend processes account and service usage data - including the metadata of the emails sent through the service, such as sender, recipient and activity logs - as an independent controller in order to operate, secure and optimise its service. This is governed by Resend’s own privacy policy. The legal basis for our disclosure is Art. 6(1)(f) GDPR.
• Google Ireland Ltd. (YouTube) receives data only after you actively consent by clicking to load an embedded video, as described in section 6.

8. International Data Transfers

Where personal data is transferred outside the European Economic Area (EEA), such transfers will occur only where appropriate safeguards are in place, including:

• European Commission Adequacy Decisions
• Standard Contractual Clauses (SCCs)
• Other lawful transfer mechanisms under GDPR

Lovable and Resend are located in the United States. Transfers to Lovable are made on the basis of the EU Standard Contractual Clauses incorporated into our data processing agreement. Resend is certified under the EU-U.S. Data Privacy Framework and additionally relies on the EU Standard Contractual Clauses, which are governed by Irish law.

9. Data Retention

We retain personal data only for as long as necessary to:

• Fulfill the purposes described in this Privacy Policy
• Comply with legal obligations
• Resolve disputes
• Enforce contractual agreements

Unless a longer statutory period applies, we apply the following retention periods:

• Contact form enquiries that do not lead to a business relationship: deleted no later than six months after the enquiry has been dealt with.
• Business correspondence and contractual documentation: six or ten years in line with the retention obligations of the German Commercial Code (§ 257 HGB) and the German Fiscal Code (§ 147 AO).
• Server log data held by our hosting and content delivery providers is retained in accordance with their own retention schedules; we have no influence over the retention period of data these providers process as independent controllers.
• Message data held in the sending account of our email provider is deleted in line with that provider’s retention settings and, in any event, no later than the deletion of the enquiry itself.

10. Data Security

We implement appropriate technical and organizational measures to protect personal data against:

• Unauthorized access
• Accidental loss
• Disclosure
• Alteration
• Destruction

Despite our efforts, no method of transmission over the internet can be guaranteed to be completely secure.

11. Automated Decision-Making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

12. Your Rights Under GDPR

Subject to applicable law, you have the following rights:

Right of Access

Request information about the personal data we hold about you.

Right to Rectification

Request correction of inaccurate or incomplete data.

Right to Erasure

Request deletion of your personal data under certain circumstances.

Right to Restrict Processing

Request that we limit the processing of your personal data.

Right to Data Portability

Receive your personal data in a structured, commonly used format.

Right to Object

Object to processing based on legitimate interests.

Right to Withdraw Consent

Withdraw consent at any time where processing is based on consent.

Right to Lodge a Complaint

You have the right to lodge a complaint with a competent data protection supervisory authority. The authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach, Germany

Data Protection Officer

We are not required to appoint a Data Protection Officer under Art. 37 GDPR or § 38 BDSG, as our processing activities do not meet the applicable thresholds. For all data protection matters, please contact us directly using the details in this policy.

13. Third-Party Links

Our website contains links to third-party websites.

We are not responsible for the privacy practices or content of external websites. We encourage users to review their privacy notices separately.

14. Professional Confidentiality

As an independent regulatory advisory practice, Regulatory Strategy Consulting Kunz treats client and prospective client information with strict confidentiality. Information shared in the context of consulting discussions, assessments, and project engagements will be handled with appropriate care and professional discretion.

15. Changes to This Privacy Policy

We update this Privacy Policy from time to time to reflect legal, regulatory, or business developments.

The latest version will always be available on this website and indicated by the "Last Updated" date at the top of this policy.

Contact

If you have any questions regarding this Privacy Policy or the processing of your personal data, please contact:

Regulatory Strategy Consulting Kunz
Dr. Erika Kunz
Email: contact@rsc-kunz.de
Website: rsc-kunz.de
Germany

Smart Regulatory Compliance. Strategy with Integrity.