Privacy Policy
How keylight GmbH processes personal data on its websites and in its marketing, sales and recruiting, including cookies, data sharing, retention and the rights available.
- Controller
- keylight GmbH, Berlin
- Data Protection Officer
- privacy@keylight.com
- Rights and requests
- privacy@keylight.com
Contents
1Introduction#
keylight GmbH (“keylight”) respects the privacy of the individuals whose personal data it processes and is committed to handling that data in accordance with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), the German Telecommunications Digital Services Data Protection Act (TDDDG) and other applicable data protection laws.
This Privacy Policy explains what personal data keylight collects, how and why it is processed, with whom it is shared, how long it is retained, and the rights available to data subjects. “Personal data” means any information relating to an identified or identifiable natural person.
2Scope of this Privacy Policy#
This Privacy Policy applies to personal data that keylight processes as a data controller in connection with:
- •
the websites www.keylight.com and offers.keylight.com and their subpages (the “Websites”);
- •
inquiries, demo requests, content downloads, event registrations, newsletter subscriptions, live chat and meeting bookings made through the Websites;
- •
marketing, sales and partner relationships, including communication with prospective and existing customers, partners and their representatives;
- •
job applications submitted through the Websites; and
- •
keylight’s presence on social media platforms, to the extent described in Section 16.
Customer Data. keylight provides a subscription management platform to business customers. Personal data that customers and their users enter into, or process through, the keylight platform (“Customer Data”) is processed by keylight as a data processor on the customer’s documented instructions, under the applicable customer agreement and Data Processing Agreement. This Privacy Policy does not apply to Customer Data. Individuals whose data is contained in Customer Data should direct their requests to the relevant keylight customer, which is the controller of that data.
The Websites may contain links to third-party websites and services. keylight is not responsible for the privacy practices of third parties, and their privacy policies apply to any data they collect.
3Data controller and contact details#
The controller responsible for the processing described in this Privacy Policy is keylight GmbH, Fasanenstraße 77, 10623 Berlin, Germany. Email: privacy@keylight.com. Telephone: +49 30 814 760 14. Managing Director: Dr. Marco Sarich. Commercial register: Amtsgericht Charlottenburg, HRB 164642 B.
Data Protection Officer. keylight has appointed a Data Protection Officer, who can be contacted at: Andrew Aitken, Data Protection Officer, c/o keylight GmbH, Fasanenstraße 77, 10623 Berlin, Germany. Email: privacy@keylight.com.
4Personal data keylight collects#
4.1Information provided to keylight#
keylight collects personal data that individuals provide directly, including:
- •
Contact and professional details: name, business email address, telephone number, company, job title and country, provided through contact, demo request, consultation, content download, event registration, partner inquiry and newsletter forms.
- •
Inquiry content: the subject and content of messages, requirements described in demo requests, and messages exchanged in live chat.
- •
Meeting details: the time slot selected and the details entered in the meeting scheduler.
- •
Event information: registration details for webinars and in-person events and, where applicable, dietary or accessibility requirements provided voluntarily.
- •
Application information: CV, cover letter, qualifications, employment history and other information submitted with a job application.
- •
Contract and account information: for representatives of customers and partners, the business contact details, role and correspondence needed to negotiate, conclude and perform agreements and to issue invoices.
Fields marked as required on a form are necessary to respond to the request. Where they are not provided, keylight may be unable to process the request.
4.2Information collected automatically#
When the Websites are accessed, keylight and its service providers collect technical and usage data automatically:
- •
Technical data: IP address, date and time of access, pages requested, referring URL, browser type and version, operating system and device type, collected in server logs by the hosting provider.
- •
Privacy region: the country (and, for Canada, the province) derived from the IP address is used to determine which privacy regime applies, and only the resulting region (for example “EEA”) is stored in a cookie. The IP address is not stored for this purpose.
- •
Usage data collected through cookies and similar technologies, subject to consent where required: pages viewed, navigation paths, interactions with buttons, forms, chat and the meeting scheduler, campaign parameters, advertising click identifiers and approximate location (country or region). Section 6 and Appendix A describe these technologies.
4.3Information obtained from other sources#
keylight also receives personal data about business contacts from sources other than the individual:
- •
Company identification: with consent to advertising cookies, the service provider Clay identifies the organization behind a visit to the Websites from the IP address of the visiting network and returns company-level information (company name, industry, size). This information relates to organizations and is not used to identify individual visitors.
- •
Advertising platforms: aggregated, non-identifying campaign reports from Google and LinkedIn.
- •
Business partners and events: contact details received from implementation, technology and alliance partners, and attendee lists from co-hosted events, where the individual has agreed to this with the partner.
- •
Publicly available professional sources: information about companies and their representatives from company websites, commercial registers and professional networks such as LinkedIn, used to keep business contact records accurate and to identify relevant contacts at organizations that may benefit from keylight’s services.
- •
Referrals: contact details provided by a customer or colleague who recommends keylight.
Where keylight obtains personal data from other sources, it informs the individual in accordance with Article 14 GDPR at the latest at the time of first communication, unless an exception applies.
5Purposes of processing and legal bases#
keylight processes personal data for the purposes and on the legal bases set out below. Under the GDPR, keylight must have a legal basis for each processing activity. The legal bases relied on are performance of a contract or pre-contractual steps (Article 6(1)(b)), compliance with a legal obligation (Article 6(1)(c)), legitimate interests (Article 6(1)(f)) and consent (Article 6(1)(a)). The storage of and access to information in the browser is governed in addition by Section 25 TDDDG.
| Purpose | Personal data | Legal basis |
|---|---|---|
| Providing the Websites, ensuring their security and stability, and detecting and preventing abuse | Technical data, server logs | Legitimate interests (Art. 6(1)(f) GDPR) in operating secure and reliable Websites |
| Determining the applicable privacy regime and recording cookie preferences | Privacy region, consent choices, consent records | Legitimate interests (Art. 6(1)(f) GDPR). Legal obligation to demonstrate consent (Art. 7(1), Art. 6(1)(c) GDPR). Section 25(2) no. 2 TDDDG |
| Protecting application forms against spam and automated abuse (reCAPTCHA) | Technical data, interaction data | Legitimate interests (Art. 6(1)(f) GDPR) |
| Providing optional features: live chat, embedded videos, meeting scheduler | Functional cookies, chat identifiers | Consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR) |
| Measuring and improving the performance of the Websites and understanding how visitors arrive and navigate | Usage data, performance cookies, campaign attribution | Consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR) |
| Measuring advertising campaigns and identifying organizations that visit the Websites | Usage data, advertising cookies, click identifiers, IP-derived company information | Consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR) |
| Responding to inquiries, demo and consultation requests, and providing requested content | Contact and professional details, inquiry content, attribution data | Pre-contractual steps (Art. 6(1)(b) GDPR). Legitimate interests (Art. 6(1)(f) GDPR) in responding to business inquiries |
| Arranging and holding meetings and events, including webinars | Contact details, meeting and event information | Pre-contractual steps (Art. 6(1)(b) GDPR). Legitimate interests (Art. 6(1)(f) GDPR) |
| Managing relationships with customers and partners, including contract negotiation, performance, invoicing and support | Contract and account information | Contract (Art. 6(1)(b) GDPR) where the individual is a party. Otherwise legitimate interests (Art. 6(1)(f) GDPR) in managing business relationships |
| Sending newsletters and marketing communications about keylight products, services, content and events | Contact details, engagement data (opens, clicks) | Consent (Art. 6(1)(a) GDPR, Section 7(2) no. 2 UWG). For existing customers, legitimate interests (Art. 6(1)(f) GDPR, Section 7(3) UWG) with the right to object at any time |
| Business development: identifying and contacting representatives of organizations that may benefit from keylight’s services | Business contact details from the sources in Section 4.3 | Legitimate interests (Art. 6(1)(f) GDPR) in business-to-business marketing, balanced against the professional context of the data and the right to object |
| Recruiting: processing job applications | Application information | Decision on the establishment of an employment relationship (Art. 6(1)(b) GDPR, Section 26 BDSG) |
| Complying with legal obligations, including commercial and tax retention requirements | Contract and invoicing records | Legal obligation (Art. 6(1)(c) GDPR, Sections 257 HGB, 147 AO) |
| Establishing, exercising or defending legal claims | Any of the above, as relevant | Legitimate interests (Art. 6(1)(f) GDPR) |
Where keylight relies on legitimate interests, it has assessed that the processing is necessary for the stated purpose and that the interests, rights and freedoms of the individuals concerned do not override those interests. Further information on the balancing assessment is available on request.
6Cookies and similar technologies#
The Websites use cookies and similar technologies (local storage, session storage and pixels) in four categories. Only necessary cookies are stored without consent.
| Category | Purpose | Consent |
|---|---|---|
| Necessary | Required for the Websites to function securely: storing cookie preferences and the privacy region, protecting application forms against spam | Not required (Section 25(2) no. 2 TDDDG) |
| Functional | Enabling optional features: live chat, embedded videos and the meeting scheduler | Required |
| Performance | Measuring how the Websites are used (also referred to as analytics cookies) | Required |
| Advertising | Measuring advertising campaigns and identifying visiting organizations | Required |
6.1Consent management#
Visitors from the European Economic Area, the United Kingdom, Switzerland and Quebec, and visitors whose location cannot be determined, are asked for consent before any functional, performance or advertising cookies are used. The consent banner offers the options Accept all, Reject all and Manage consent. “Reject all” retains only necessary cookies. Visitors in other regions are described in Sections 14 and 15.
Consent may be changed or withdrawn at any time via Manage consent in the footer of every page. Withdrawal does not affect the lawfulness of processing carried out before it. Upon withdrawal, keylight deletes the cookies it has set on its own domain. Cookies set by third parties on their own domains are no longer renewed and expire, and may also be deleted through the browser settings. A consent choice is stored for twelve months, or six months where all optional cookies are rejected, after which consent is requested again. Consent is also requested again when the categories or providers change.
6.2Records of consent#
To demonstrate consent in accordance with Article 7(1) GDPR, keylight records each consent decision in its own systems: a random identifier (also held in the kl_consent cookie), the categories accepted or rejected, the date and time, the version of this policy, the privacy region and the website concerned. No IP address or browser information is stored with the record. Records are deleted after three years.
6.3Google Consent Mode#
Consent choices are transmitted to Google tags through Google Consent Mode. Where consent to performance or advertising cookies has not been given, the corresponding Google tags are not executed and set no cookies.
A complete list of the cookies and similar technologies used, including provider, purpose and storage duration, is provided in Appendix A and in the Manage consent dialog on the Websites.
7Analytics and advertising technologies#
7.1Google Tag Manager#
keylight uses Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), to load analytics and advertising tags in accordance with the visitor’s consent. Google Tag Manager is loaded only after consent to performance or advertising cookies has been given. It does not set cookies itself. Loading it transmits the IP address to Google.
7.2Google Analytics 4#
With consent to performance cookies, keylight uses Google Analytics 4 to analyze the use of the Websites: pages viewed, traffic sources and campaigns, interactions with key buttons, form views and submissions, meeting bookings, chat starts, device and browser information, approximate location (country and region) and the applicable privacy region. Google Analytics 4 does not log or store IP addresses of visitors from the European Union. keylight does not transmit names, email addresses or other form content to Google Analytics. Google signals (demographics and interests reporting) are disabled. Data is retained in Google Analytics for 14 months. Google may process this data in the United States (Section 10).
7.3HubSpot analytics#
With consent to performance cookies, keylight uses the analytics functions of HubSpot, its customer relationship management system, provided by HubSpot Ireland Limited, 1 Sir John Rogerson’s Quay, Dublin 2, Ireland (“HubSpot”). HubSpot records the pages visited and the time of each visit. When a form is subsequently submitted, HubSpot associates earlier visits from the same browser with the inquiry, so that keylight’s sales team can understand the areas of interest of a prospective customer.
7.4Campaign attribution#
With consent to performance cookies, keylight stores the campaign parameters (for example utm_source), the landing page and the referrer of the first visit in its own cookie kl_first_touch for twelve months. When a form is submitted, the following are recorded with the inquiry where available: first-visit campaign parameters, referring website, advertising click identifiers from Google and LinkedIn, an advertising identifier from the campaign link, the Google Analytics browser identifier and the consent status. Identifiers that depend on cookies are present only where the corresponding category has been consented to.
7.5Google Ads#
With consent to advertising cookies, keylight uses Google Ads conversion tracking to measure which advertisements lead to inquiries and meeting bookings. When a visitor arrives from a Google advertisement, the Google click identifier is stored in a cookie. keylight uses Google’s enhanced conversions, under which a hashed (pseudonymized) form of the email address submitted in a form is transmitted to Google to improve the accuracy of conversion measurement.
7.6LinkedIn Insight Tag#
With consent to advertising cookies, keylight uses the LinkedIn Insight Tag of LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland (“LinkedIn”), to measure the performance of LinkedIn campaigns and to receive aggregated, non-identifying reports on the professional characteristics of visitors, such as industry and job function. LinkedIn may use the data collected through the Insight Tag to display relevant advertisements to LinkedIn members, under LinkedIn’s own responsibility and privacy policy.
7.7Clay#
With consent to advertising cookies, keylight uses Clay, provided by Clay Labs, Inc., New York, USA, to identify the organization behind a visit from the IP address of the visiting network. Clay processes the IP address, the pages viewed, the time of the visit and browser information, and holds identifiers in the browser’s session storage for the duration of the visit. keylight uses the resulting company-level information to understand which organizations show interest in its services. Clay is not used to identify individual visitors. Data is transferred to the United States (Section 10).
7.8Embedded videos#
Certain pages embed videos hosted by YouTube (Google) and Vimeo (Vimeo.com, Inc., 330 West 34th Street, New York, NY 10001, USA). YouTube videos are embedded in privacy-enhanced mode and Vimeo videos in do-not-track mode, which disables Vimeo’s viewing analytics. A video player is loaded only when the visitor plays the video, or automatically where consent to functional cookies has been given. When the player loads, the provider receives the IP address and technical data and may store information in the browser.
7.9Google reCAPTCHA#
Job application forms are protected by Google reCAPTCHA, which analyzes technical information from the browser, such as the IP address, browser characteristics and interaction patterns, to distinguish people from automated programs. reCAPTCHA is loaded only on pages containing an application form.
8Marketing communications#
keylight sends newsletters, product updates, event invitations and other marketing communications by email only with the recipient’s prior consent, or, in the case of existing customers, on the basis of Section 7(3) of the German Act Against Unfair Competition (UWG) in relation to similar products and services.
Marketing emails are sent through HubSpot. HubSpot records whether an email has been opened and which links have been clicked, so that keylight can measure and improve the relevance of its communications. Every marketing email contains an unsubscribe link. Recipients may also object to marketing communications at any time by contacting privacy@keylight.com. Objection does not affect transactional communications relating to an existing agreement.
keylight may contact representatives of organizations by telephone or through professional networks for business-to-business sales purposes, in accordance with applicable law and with the right to object at any time.
9Disclosure of personal data#
keylight discloses personal data only as described in this Privacy Policy. keylight does not sell personal data for monetary consideration. Recipients include:
- •
Service providers (processors) that process personal data on keylight’s behalf and on its documented instructions, under data processing agreements in accordance with Article 28 GDPR. The principal service providers are listed in the table below.
- •
Advertising and analytics partners that act as independent controllers for their own purposes, to the extent consented to: Google, LinkedIn and Clay (Section 7).
- •
Business partners: implementation, technology and alliance partners, where a prospective customer requests or agrees to be introduced to a partner, or where a partner is involved in delivering a project.
- •
Professional advisors: lawyers, auditors, tax advisors and insurers, where necessary.
- •
Public authorities and courts, where required by law, regulation or legal process, or to establish, exercise or defend legal claims.
- •
Acquirers or successors in the event of a merger, acquisition, financing or sale of all or part of keylight’s business, subject to confidentiality obligations and this Privacy Policy.
| Service provider | Service | Location and transfer mechanism |
|---|---|---|
| Vercel Inc., USA | Website hosting, with server functions in Frankfurt, Germany | EU-US Data Privacy Framework certification |
| Neon, Inc., USA | Website content database (region Frankfurt, Germany) | EU region. Data processing agreement with the Standard Contractual Clauses |
| Amazon Web Services EMEA SARL, Luxembourg | Storage of images and files (region eu-central-1, Frankfurt) | EU. Amazon Web Services, Inc. is certified under the EU-US Data Privacy Framework |
| HubSpot Ireland Limited / HubSpot, Inc., USA | CRM, forms, live chat, meeting scheduler, email marketing, analytics | USA. EU-US Data Privacy Framework certification and Standard Contractual Clauses |
| Google Ireland Limited / Google LLC, USA | Tag Manager, Analytics, Ads, reCAPTCHA, YouTube | EU-US Data Privacy Framework certification |
| LinkedIn Ireland Unlimited Company / LinkedIn Corporation, USA | Insight Tag, campaign reporting | EU-US Data Privacy Framework certification and Standard Contractual Clauses |
| Clay Labs, Inc., USA | Company identification | Standard Contractual Clauses |
| Vimeo.com, Inc., USA | Video hosting | Standard Contractual Clauses |
10International data transfers#
keylight is established in Germany and stores personal data primarily within the European Union. Some service providers and advertising partners are established in, or have group companies in, the United States and other countries outside the European Economic Area (EEA), where data protection laws may differ from those in the EEA.
Where personal data is transferred outside the EEA, the United Kingdom or Switzerland, keylight ensures an adequate level of protection through one of the following safeguards: an adequacy decision of the European Commission, including the EU-US Data Privacy Framework (DPF) for recipients certified under it; the Standard Contractual Clauses adopted by the European Commission (Article 46(2)(c) GDPR), supplemented where necessary by additional measures; or, for consent-based analytics and advertising technologies, the explicit consent of the individual to the transfer (Article 49(1)(a) GDPR), of which this Section provides the information. A copy of the safeguards in place may be requested from privacy@keylight.com.
11Data retention#
keylight retains personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting or reporting requirements, and deletes or anonymizes it thereafter. The following criteria apply:
| Category | Retention period or criterion |
|---|---|
| Server logs | Retained by the hosting provider for a short period for security and troubleshooting, then deleted |
| Cookies and similar technologies | The storage durations stated in Appendix A, or until withdrawal of consent |
| Consent records | Three years from the consent decision |
| Google Analytics data | 14 months |
| Inquiries from prospective customers and other business contacts | For the duration of the business relationship or, where no relationship results, for as long as needed to follow up on the inquiry, unless a longer period is required by law |
| Customer and partner contract data | For the term of the agreement and the statutory retention periods thereafter: six years for commercial correspondence and ten years for accounting records (Sections 257 HGB, 147 AO) |
| Live chat transcripts | Together with the inquiry record of the conversation, as above |
| Marketing communications and consent | Until withdrawal of consent or objection. Proof of consent for three years thereafter |
| Job applications | Six months after the end of the application process, unless the applicant has consented to a longer retention |
| Data required for legal claims | Until the expiry of the applicable limitation periods |
Backup copies may persist for a limited period after deletion from active systems and are overwritten in the ordinary course of operations.
12Data security#
keylight implements appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration or disclosure, taking into account the state of the art and the risks of the processing (Article 32 GDPR). These measures include transport encryption (TLS) for all pages and data submitted through the Websites, role-based access controls and the principle of least privilege, logging and monitoring, secure development practices, and contractual obligations on service providers. keylight operates an information security management system certified under ISO/IEC 27001. The transmission of information over the internet is never entirely secure, and keylight cannot guarantee the security of data transmitted to the Websites.
13Rights of data subjects#
Subject to the conditions set out in the GDPR, individuals have the following rights in relation to their personal data:
- •
Right of access (Article 15): to obtain confirmation as to whether personal data is being processed, and access to that data and related information.
- •
Right to rectification (Article 16): to have inaccurate personal data corrected and incomplete data completed.
- •
Right to erasure (Article 17): to have personal data deleted where there is no longer a legal basis for its retention.
- •
Right to restriction of processing (Article 18).
- •
Right to data portability (Article 20): to receive personal data provided to keylight in a structured, commonly used and machine-readable format.
- •
Right to object (Article 21): to object at any time, on grounds relating to the individual’s particular situation, to processing based on legitimate interests, and to object at any time, without giving reasons, to processing for direct marketing purposes.
- •
Right to withdraw consent (Article 7(3)): at any time with effect for the future, without affecting the lawfulness of processing based on consent before its withdrawal. Consent to cookies may be withdrawn via Manage consent in the footer of the Websites.
- •
Right to lodge a complaint (Article 77) with a supervisory authority, in particular in the Member State of habitual residence, place of work or place of the alleged infringement. The supervisory authority responsible for keylight is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany, https://www.datenschutz-berlin.de.
Requests may be submitted to privacy@keylight.com or to the postal address in Section 3. keylight responds within one month of receipt, extendable by two further months where necessary. keylight may request information to verify the identity of the person making the request. The exercise of these rights is free of charge, except where requests are manifestly unfounded or excessive.
keylight does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning individuals or similarly significantly affect them (Article 22 GDPR).
14Supplemental notice for residents of the United States#
This Section supplements the Privacy Policy for individuals residing in US states with comprehensive privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA).
14.1Categories of personal information#
In the preceding twelve months, keylight has collected the following categories of personal information, as defined in the CCPA, from the sources and for the purposes described in Sections 4 and 5:
| Category | Examples | Disclosed to | Sold or shared |
|---|---|---|---|
| Identifiers | Name, email address, telephone number, IP address, cookie and advertising identifiers | Service providers, advertising partners | Shared with advertising partners (Google, LinkedIn, Clay) for cross-context behavioral advertising and measurement, unless opted out |
| Customer records (Cal. Civ. Code § 1798.80(e)) | Name, company, business contact details | Service providers | No |
| Commercial information | Inquiries, demo requests, content downloaded, events attended | Service providers | No |
| Internet or other electronic network activity | Pages viewed, interactions, referring website, campaign parameters | Service providers, advertising partners | Shared with advertising partners, unless opted out |
| Geolocation data | Approximate location derived from the IP address (country, region) | Service providers, advertising partners | Shared with advertising partners, unless opted out |
| Professional or employment-related information | Job title, company, employment history (applicants) | Service providers | No |
| Inferences | Areas of interest in keylight’s services derived from website activity | Service providers | No |
keylight does not collect sensitive personal information as defined in the CCPA through the Websites, does not knowingly sell or share the personal information of consumers under 16 years of age, and does not offer financial incentives in exchange for personal information. Retention periods are stated in Section 11.
14.2Sale and sharing, and how to opt out#
keylight does not sell personal information for monetary consideration. Under the CCPA, the use of advertising cookies and similar technologies by Google, LinkedIn and Clay may constitute “sharing” of personal information for cross-context behavioral advertising. Visitors from the United States may opt out at any time through the Do Not Sell or Share My Personal Information link in the footer of the Websites or through Manage consent, which switches off advertising cookies and, if desired, performance and functional cookies. keylight treats browser-based opt-out preference signals, including Global Privacy Control, as a valid request to opt out of sale and sharing for that browser.
14.3Rights#
Residents of California and other states with comprehensive privacy laws may have the right to know the categories and specific pieces of personal information collected, the sources, the purposes, and the categories of third parties to which it was disclosed. They may also have the right to correct inaccurate personal information, to delete personal information, subject to exceptions, to opt out of sale and sharing, and not to be discriminated against for exercising these rights. Requests may be submitted to privacy@keylight.com or by telephone at +49 30 814 760 14. keylight will verify requests by matching the information provided with the information it holds and may request additional information for that purpose. An authorized agent may submit a request on a consumer’s behalf with written authorization. keylight may require the consumer to verify their identity directly. If a request is denied, the consumer may appeal by replying to the decision.
15Supplemental notice for residents of Canada#
keylight processes the personal information of individuals in Canada in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws. Visitors from Quebec are asked for consent before any functional, performance or advertising cookies are used, in accordance with the Act respecting the protection of personal information in the private sector (Law 25). Visitors from other provinces may opt out of optional cookies at any time through Manage consent in the footer of the Websites.
The person in charge of the protection of personal information at keylight is Dr. Marco Sarich, Managing Director, who can be reached at privacy@keylight.com. Personal information may be processed outside Canada, including in Germany and the United States, under the safeguards described in Section 10. Individuals in Canada have the right to access and correct their personal information and to withdraw consent, subject to legal and contractual restrictions, and may lodge a complaint with the Office of the Privacy Commissioner of Canada or, for Quebec, the Commission d’accès à l’information.
16Social media presence#
keylight maintains a company page on LinkedIn. When individuals visit or interact with that page, LinkedIn processes their personal data under its own responsibility and privacy policy. keylight receives aggregated statistics about page visitors and followers (“Page Insights”). For the processing of Page Insights data, keylight and LinkedIn are joint controllers and have concluded a joint controller arrangement under Article 26 GDPR, which is available from LinkedIn. keylight has no access to the underlying personal data. Direct messages and comments received through the page are processed to respond to them, on the basis of keylight’s legitimate interest in communicating with its audience (Article 6(1)(f) GDPR). Requests concerning data processed by LinkedIn should be addressed to LinkedIn.
17Children#
The Websites and keylight’s services are directed at businesses and their representatives. keylight does not knowingly collect personal data from children under the age of 16. If keylight becomes aware that it has collected personal data from a child without appropriate consent, it will delete that data.
18Changes to this Privacy Policy#
keylight may update this Privacy Policy from time to time to reflect changes in its processing activities, the Websites or applicable law. The current version is published on the Websites with its effective date. Where changes are material, keylight will provide additional notice where appropriate, and will request consent again where the categories or providers of cookies change.
19Contact#
Questions, requests and complaints concerning this Privacy Policy or keylight’s processing of personal data may be addressed to: keylight GmbH, Data Protection, Fasanenstraße 77, 10623 Berlin, Germany. Email: privacy@keylight.com.
Appendix ACookies and similar technologies#
The following cookies and similar technologies are used on the Websites. Storage durations are those set by keylight or published by the respective provider. “Session” denotes storage until the browser tab or window is closed. Cookies set by third parties on their own domains are controlled by those providers and cannot be deleted by keylight.
Necessary (always active)#
Required for the website to function securely. These cookies store cookie preferences and protect application forms against spam, and cannot be disabled.
| Cookie | Duration | Description | Provider |
|---|---|---|---|
| kl_consent | 12 months (6 months if all optional cookies are rejected) | Stores cookie preferences. | keylight |
| kl_region | 30 days | Stores the privacy region derived from the country of access, so that the appropriate cookie notice is shown. No IP address is stored. | keylight |
| _GRECAPTCHA | 6 months | Protects job application forms against spam and abuse. Set only on pages with an application form. | Google reCAPTCHA |
Functional#
Enable optional features such as live chat and embedded videos. When disabled, live chat is unavailable and videos load only when played.
| Cookie | Duration | Description | Provider |
|---|---|---|---|
| messagesUtk | 6 months | Maintains the history of a live chat conversation. | HubSpot |
| hs-messages-is-open | 30 minutes | Stores whether the chat window is open. | HubSpot |
| hs-messages-hide-welcome-message | 1 day | Prevents the chat welcome message from reappearing once dismissed. | HubSpot |
| Video players | Defined by the provider | Play embedded videos in privacy-enhanced mode (YouTube) and do-not-track mode (Vimeo). Player settings may be stored once a video is played. | YouTube, Vimeo |
| Meeting scheduler | Defined by the provider | Displays available meeting times. Loads only when the calendar is opened. | HubSpot |
Performance#
Provide insight into how the website is used, such as which pages are visited and how visitors arrive, so that it can be improved. When a form is submitted, HubSpot associates earlier visits from the same browser with the inquiry.
| Cookie | Duration | Description | Provider |
|---|---|---|---|
| _ga | 2 years | Distinguishes visitors for website statistics. | Google Analytics |
| _ga_* | 2 years | Maintains the state of the current session. | Google Analytics |
| __hstc | 6 months | Stores visit timestamps and the number of sessions for website statistics. | HubSpot |
| hubspotutk | 6 months | Stores a visitor identifier that associates website visits with submitted forms. | HubSpot |
| __hssc | 30 minutes | Counts page views within a session. | HubSpot |
| __hssrc | Session | Detects the start of a new browser session. | HubSpot |
| kl_first_touch | 12 months | Stores the campaign and landing page of the first visit, for attributing inquiries. | keylight |
Advertising#
Measure the performance of keylight advertising on Google and LinkedIn and provide company-level insight into website visits. These providers may combine this information with other data they hold.
| Cookie | Duration | Description | Provider |
|---|---|---|---|
| _gcl_au, _gcl_aw | 90 days | Measure conversions from Google Ads campaigns. | Google Ads |
| IDE | 13 months (24 months outside the EEA, Switzerland and the UK) | Measures the effectiveness of Google advertising. | Google (doubleclick.net) |
| li_fat_id | 30 days | Attributes conversions to LinkedIn ad clicks. | |
| li_sugr | 90 days | Improves the accuracy of LinkedIn advertising measurement. | |
| bcookie | 1 year | Browser identifier used by LinkedIn for security and diagnostics. | |
| lidc | 24 hours | Routes requests to the appropriate LinkedIn data center. | |
| UserMatchHistory, AnalyticsSyncHistory | 30 days | Synchronize LinkedIn advertising measurement data. | |
| lms_ads, lms_analytics | 30 days | Support LinkedIn advertising measurement and reporting. | |
| li_gc | 6 months | Stores LinkedIn cookie consent preferences. | |
| claydar_*, radar_sn_* | Session | Provide company-level insight into website visits, based on the IP address of the visiting network. Held in session storage. | Clay |