Privacy Policy

Controller

The controller responsible for data processing on this website is: Mansour Kalagar, Ria-Burkei-Straße 25, 81249 München, email: mansour@kalagar.net.

Hosting and server logs (Vercel)

This website is hosted by Vercel Inc. (USA) and served from the fra1 region (Frankfurt am Main). Vercel also provides the Web Application Firewall (WAF) that protects the website against abuse and attacks.

When you open a page, Vercel processes technically necessary data such as IP address, time, requested address, referrer and browser identifier in server logs. This serves the secure and stable operation of the website (Art. 6(1)(f) GDPR). A transfer to the USA cannot be ruled out.

Fonts are served by this website itself; no fonts are requested from third parties when pages load.

Cookies and local storage

The cookie “kalagar-theme” stores whether you chose the light or dark colour scheme and is kept for one year. It contains no personal data, is used only to display this website and is technically required for the function you requested (§ 25(2) no. 2 TDDDG).

The cookie “kalagar-currency” stores, on the Persian pages, whether you want to see prices in Toman or euros and is kept for one year. It contains no personal data. When you book, the chosen currency is stored with the booking and decides the payment method offered (Toman: PayPing or card-to-card, euros: PayPal). The cookie is technically required for the function you requested (§ 25(2) no. 2 TDDDG).

In the video gallery, your chosen view is stored in your browser's sessionStorage. This information never leaves your browser and is deleted when you close the tab.

The booking form stores a sessionStorage draft containing name, email address and request identifier (requestId) to preserve input on reload. It is removed after a successful reservation or when the tab closes. Service and slot selection may appear in the URL; they are not part of this draft.

Web analytics (Plausible)

Plausible Analytics (Plausible Insights OÜ, Estonia) is used to measure reach. Plausible sets no cookies and creates no user profiles; IP addresses are only used to form a daily rotating anonymous identifier and are not stored.

The legal basis is our legitimate interest in a data-minimising evaluation of how this website is used (Art. 6(1)(f) GDPR).

YouTube videos

The video gallery shows thumbnails loaded through this website's server; opening the gallery does not connect your browser to YouTube.

Only when you select a video is the YouTube player (Google Ireland Limited, Ireland; Google LLC, USA) loaded: the player script from www.youtube.com and the video in privacy-enhanced mode via www.youtube-nocookie.com. In particular, your IP address and information about the video played are transmitted to Google; a transfer to the USA is possible. The legal basis is Art. 6(1)(f) GDPR; the connection is only made by your selection.

Booking a session

You supply your name and email address to book. The system also processes service, session time, language, time zone, a normalized email lookup key (emailKey), request and booking identifiers, status, and creation, expiry and notification data. If you request a cancellation on the status page, the system stores the request, its time and an optional cancel reason you give (later also a reschedule note) in the booking; Mansour receives the request and the reason by email. Vercel processes this information to run the booking; IP addresses are also processed temporarily for abuse limiting.

The booking is stored in Google Calendar in the dedicated booking account. Its Gmail sends booking messages; the admin mailbox mansour@kalagar.net receives booking information and replies. After confirmation, the visitor and administrator are invited as attendees; invitations and independent calendar copies may be stored by their providers. Confirmed sessions use Google Meet, which also processes connection data and content you share in the session.

The booking account uses Google consumer terms; there is no data processing agreement under Art. 28 GDPR. Google (Google Ireland Limited; Google LLC, USA) is a recipient. Processing in the USA is possible; Google describes the EU-US Data Privacy Framework among its transfer mechanisms. This does not replace a data processing agreement.

The legal basis for booking and the session is Art. 6(1)(b) GDPR; technical abuse prevention relies on Art. 6(1)(f) GDPR.

Payment via PayPal

If you pay for a session booked through this website's booking form, payment is made via PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. PayPal processes the payment data under its own responsibility; we receive from PayPal the details needed to match the payment. The legal basis is Art. 6(1)(b) GDPR.

Payment in Toman (PayPing, card-to-card)

For bookings made in Persian, payment can alternatively be made in Toman via PayPing (Iran). When you choose PayPing, this website sends PayPing the booking reference and the amount and forwards you to PayPing's payment page; afterwards it asks PayPing to verify the payment and confirms the booking automatically. PayPing's responses also contain a masked card number and a card hash; this website neither stores nor logs them and keeps only PayPing's payment identifiers in the booking. PayPing processes the payment data under its own responsibility. Iran is a third country without an adequacy decision of the EU Commission; a level of data protection equivalent to EU law is not guaranteed there. Using it is voluntary; PayPal remains available. The legal basis is Art. 6(1)(b) GDPR.

While PayPing is unavailable, a booking made in Persian can be paid in Toman by card-to-card transfer to our Iranian bank account. For this, the website only shows the card number, the Sheba number if any, and the holder of that account. After transferring, you can enter the bank tracking number and the last 4 digits of your card on the booking status page; the website stores both with the booking only to match the payment, never more card digits, and sends them to us by email. You make the transfer through your own bank; our bank gives us the details needed to match the payment (amount, time and, where applicable, the sender's name), and we confirm the booking by hand. A transfer receipt you send us by email is processed only to match the payment. The banks involved are in Iran, a third country without an EU Commission adequacy decision. Use is voluntary; PayPal remains available. The legal basis is Art. 6(1)(b) GDPR.

Automated maintenance (GitHub)

GitHub Inc. (USA) regularly triggers booking maintenance at Vercel. The application returns only success and counts (ok, processed, remaining, failed), without visitor names, email addresses or booking content to GitHub. GitHub also processes account and technical data needed to operate the maintenance job.

Contact form and Telegram

If you use this website's contact form, your name, your email address, your message, the page language and the time of submission are processed. This data is not stored on this website but forwarded via a Telegram bot directly to the controller's private Telegram chat.

The recipient is Telegram (Telegram Messenger Inc. or Telegram FZ-LLC, Dubai, United Arab Emirates). The data is therefore transferred to a third country for which there is no adequacy decision of the EU Commission; a level of data protection equivalent to EU law is not guaranteed there. If you do not want this, please write to the email address above instead.

The sole purpose is to handle and answer your request. The legal basis is Art. 6(1)(b) GDPR where your request concerns a contract or pre-contractual measures, otherwise our legitimate interest in answering requests (Art. 6(1)(f) GDPR).

The message remains stored in Telegram until your request has been dealt with, for at most 12 months; it is then deleted.

The confirmation email offers an optional private Telegram contact for sending a CV before the session. If you use it, Telegram processes your contact details, messages and voluntarily supplied documents, subject to the third-country risks described above. This is voluntary; you can use the public email address instead. The personal contact is not published on the website.

This website optionally links to a Telegram channel (Telegram Messenger Inc.). Data is only transmitted to Telegram when you follow that link; Telegram's privacy policy then applies.

Legal bases

Booking data (this website's booking form, PayPal, PayPing) and contact form requests concerning a contract are processed to carry out pre-contractual measures and the contract (Art. 6(1)(b) GDPR).

Security logs, reach measurement, the YouTube player after your selection and answering other contact form requests are based on our legitimate interest in the secure operation, improvement and functionality of this website (Art. 6(1)(f) GDPR).

The cookies “kalagar-theme” and “kalagar-currency” are technically required (§ 25(2) no. 2 TDDDG).

Retention

For bookings made through this website’s booking form:

Cancelled or expired events are deleted only after the related notification’s send status has been acknowledged in the event. The regularly triggered, bounded maintenance run can be delayed by pending messages, failed acknowledgements, backlogs or provider failures; deletion within one hour is not guaranteed. Acknowledged sending does not prove delivery to an inbox.

For confirmed sessions, the first successful eligible maintenance run from 90 days after session end removes name, email address, emailKey, any reported bank tracking number and last 4 card digits, any cancel reason or reschedule note, and the visitor attendee, even if mail is still pending. Other operational data remains, including identifiers, status, service, language, time zone, timestamps, notification status, Meet data and the administrator attendee. Provider failures can delay cleanup. This does not reliably erase independently held attendee calendar copies.

Mansour manually cleans up booking messages older than 90 days each month in both the booking mailbox and the admin mailbox mansour@kalagar.net. Labelled messages and missed Sent and Inbox copies are reviewed, and matching Trash messages are permanently deleted. Retention can exceed 90 days until the monthly review; without permanent deletion, Gmail messages remain in Trash for up to 30 days. Required statutory retention or legal claims may justify longer, restricted retention.

Contact form messages are not stored on this website; in Telegram they are deleted once the request has been dealt with, at the latest after 12 months.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR). Please contact the email address above; we reply within one month.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).