Skip to content
NewThe construction diary with AI support · Read the article

Search the website

Popular
↑↓ select↵ openEsc closeSearch any time with Strg K

Privacy policy

1. Privacy at a glance

General information

The following gives a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. Detailed information follows in the sections below.

Data collection on this website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator, Behuf GmbH. You will find the contact details under "Controller" and in the legal notice.

How do we collect your data?

Some data is collected when you provide it to us, for example via the contact form.

Other data is collected automatically by our IT systems when you visit the website. This is mainly technical data (e.g. browser, operating system or time of access). Statistics via Google Analytics are only collected with your consent.

What do we use your data for?

Some data is collected to ensure the website is provided without errors. We use enquiries to answer them. With your consent we also analyse which content is read. We do not build advertising profiles.

What rights do you have regarding your data?

You have the right at any time to receive information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can withdraw it at any time with effect for the future. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data, and you have the right to lodge a complaint with the competent supervisory authority.

You can contact us at any time about this and any other questions on data protection.

2. Hosting

Operated by us in Germany

We operate this website ourselves on servers rented from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in Hetzner's data centres in Nuremberg and Falkenstein. We do not use a content delivery network (CDN) or a third-party proxy service. Fonts, images, video preview images and downloads are delivered from our own server.

Hetzner provides the servers, data centres and network connection. The data generated when you visit this website (in particular IP addresses, server log data and contact enquiries) is processed on these servers.

This is based on our legitimate interest in providing our website securely, quickly and efficiently (Art. 6(1)(f) GDPR) and, where enquiries are concerned, on taking steps prior to entering into a contract (Art. 6(1)(b) GDPR).

Data processing agreement

We have concluded a data processing agreement with Hetzner in accordance with Art. 28 GDPR. Hetzner processes the data only on our instructions.

3. General information and mandatory information

Data protection

We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy. It explains what data we collect, what we use it for and on which legal basis.

Please note that data transmitted over the internet (e.g. by e-mail) may be subject to security gaps. Complete protection of data against access by third parties is not possible.

Controller

The controller responsible for data processing on this website is:

Behuf GmbH
Kirchenweg 19
90419 Nuremberg, Germany

Phone: +49 911 477 133 80
E-mail: info@kanbau.com

The controller is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data (e.g. names, e-mail addresses).

Storage period

Unless a more specific storage period is stated in this privacy policy, your personal data remains with us until the purpose for processing no longer applies. If you make a justified request for deletion or withdraw your consent, your data will be deleted unless we have other legally permissible reasons for storing it (e.g. retention periods under tax or commercial law); in that case it will be deleted once those reasons no longer apply.

We process your data on the basis of your consent (Art. 6(1)(a) GDPR), to perform a contract or take steps prior to entering into a contract (Art. 6(1)(b) GDPR), to comply with legal obligations (Art. 6(1)(c) GDPR) or on the basis of our legitimate interest (Art. 6(1)(f) GDPR). Information is only stored on or read from your device (e.g. cookies) where this is strictly necessary for a service you have requested (Section 25(2) no. 2 TDDDG) or with your consent (Section 25(1) TDDDG). The applicable legal basis is stated in each section below.

Transfers to third countries

We use services through which data may be transferred to companies in the USA: Google Analytics (only with consent), YouTube (only after you click a video) and the e-mail service provider Postmark for sending the contact and application forms. Google LLC is certified under the EU-US Data Privacy Framework; transfers to certified companies are covered by an adequacy decision of the European Commission (Art. 45 GDPR). Google also agrees to the EU standard contractual clauses.

Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time. You can withdraw your cookie consent with one click via the cookie icon at the bottom left or via "Cookie settings" in the footer. The lawfulness of processing carried out before the withdrawal remains unaffected.

Right to object (Art. 21 GDPR)

If data processing is based on Art. 6(1)(e) or (f) GDPR, you have the right to object at any time to the processing of your personal data on grounds relating to your particular situation; this also applies to profiling based on these provisions. If you object, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims (objection under Art. 21(1) GDPR).

If your personal data is processed for direct marketing purposes, you have the right to object at any time to processing for such marketing; this also applies to profiling insofar as it is related to such direct marketing. If you object, your personal data will no longer be used for direct marketing (objection under Art. 21(2) GDPR).

Right to lodge a complaint with a supervisory authority

In the event of breaches of the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany. This right is without prejudice to any other administrative or judicial remedies.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done where technically feasible.

Information, deletion and correction

Within the framework of the applicable legal provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of processing, and, where applicable, a right to correction or deletion of this data. You can contact us at any time about this and other questions regarding personal data.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data in the following cases:

  • If you dispute the accuracy of your personal data stored by us, we usually need time to verify this. For the duration of the check you can request restriction of processing.
  • If the processing of your personal data was or is unlawful, you can request restriction of processing instead of deletion.
  • If we no longer need your personal data but you need it to exercise, defend or assert legal claims, you can request restriction of processing instead of deletion.
  • If you have lodged an objection under Art. 21(1) GDPR, your interests and ours must be weighed. As long as it has not been determined whose interests prevail, you can request restriction of processing.

If you have restricted the processing of your personal data, this data – apart from being stored – may only be processed with your consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a member state.

SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, such as enquiries you send to us, this site uses TLS encryption. You can recognise an encrypted connection by the browser address line starting with "https://" and by the lock icon. When encryption is active, the data you send to us cannot be read by third parties.

Objection to advertising e-mails

We hereby object to the use of contact data published as part of our legal notice obligation for sending unsolicited advertising and information material. We expressly reserve the right to take legal action in the event of unsolicited advertising, such as spam e-mails.

4. Data collection on this website

On your first visit, a banner asks whether you consent to statistics with Google Analytics. "Reject all" is as easy to reach as "Accept all". Nothing is loaded from Google until you consent.

We store your choice in the cookie kb_consent on your device. It only contains your decision (statistics yes or no), the banner version and the time – no identifier. It is deleted after 12 months, after which we ask again. We also ask again if the banner changes significantly. The legal basis is Section 25(2) no. 2 TDDDG, as we could not otherwise respect your decision, and Art. 6(1)(c) GDPR (proof of consent).

After you have decided, a small cookie icon appears at the bottom left. A green tick shows that statistics are allowed; a grey dash shows that only necessary cookies are active. Clicking it opens the settings so you can change or withdraw your choice. If you withdraw, we stop measuring and delete the Google Analytics cookies.

Server log files

Our server automatically collects and stores information in server log files that your browser transmits automatically. These are:

  • requested address and time of the request
  • IP address
  • browser type and version, operating system
  • referrer URL (the previously visited page)

This data is not combined with other data sources. It is collected on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in providing the website securely and without technical errors, in particular in defending against attacks and analysing errors.

Contact form

If you send us an enquiry via the contact form, we process your details (name, e-mail address and message, optionally company and phone number, the selected topic and the page from which you send the form) to answer your enquiry and any follow-up questions. The form can only be sent once you confirm that you have read this privacy policy.

Our server forwards the enquiry by e-mail to our mailbox, where it is handled; we do not store it in a website database. We send a short confirmation with your name to the e-mail address provided; it does not contain your message. To send these e-mails we use the e-mail service provider Postmark as a processor: AC PM LLC (Postmark), 1 N Dearborn Street, Suite 500, Chicago, IL 60602, USA. Postmark processes the content of the e-mail only to deliver it on our behalf. Processing location USA, safeguarded by the EU-US Data Privacy Framework and additionally EU standard contractual clauses. To prevent abuse, we briefly count how many enquiries come from an IP address. This counter is kept only in the server's memory, applies for one hour at a time and is not stored permanently.

Processing is based on Art. 6(1)(b) GDPR where your enquiry relates to the performance of a contract or is necessary for steps prior to entering into a contract (e.g. a product presentation or demo access). In all other cases, processing is based on our legitimate interest in handling enquiries effectively (Art. 6(1)(f) GDPR). We do not pass this data on without your consent.

The data remains with us until you ask us to delete it, withdraw your consent to storage, or the purpose for storing it no longer applies (e.g. after your enquiry has been dealt with). Mandatory statutory provisions – in particular retention periods – remain unaffected.

Enquiries by e-mail or phone

If you contact us by e-mail or phone, your enquiry including all resulting personal data (name, enquiry) will be stored and processed to deal with your request. We do not pass this data on without your consent. Legal bases and storage period are the same as for the contact form.

Reference map

On the references page we show on a map in which regions of the German-speaking countries kanbau is used. The map only shows regions and general activity information – no customer names, no addresses and no figures. No personal data is processed for it. The map data is delivered by our own server; no external map services are loaded.

5. Statistics

With your consent, this website uses Google Analytics 4. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics shows us which pages are visited, how long they are read, how visitors reach the website and which devices and browsers are used. We use these reports to improve content and usability. We technically refuse advertising-related storage and personalisation (Google Consent Mode: ad_storage, ad_user_data and ad_personalization "denied"); we do not use the data for advertising.

For this, Google Analytics sets the cookies _ga and ga<ID>, which recognise your browser via a random identifier. Google Analytics 4 does not log or store IP addresses. The information collected may be transferred to servers of Google LLC in the USA (see "Transfers to third countries").

Processing is based exclusively on your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Without consent, the Google script is not loaded. You can withdraw your consent at any time via the cookie icon at the bottom left or "Cookie settings" in the footer.

Data processing agreement

We have concluded a data processing agreement with Google.

Storage period

User- and event-level data is deleted by Google after a maximum of 14 months. Details: https://support.google.com/analytics/answer/7667196?hl=en. More on how Google Analytics handles user data: https://support.google.com/analytics/answer/6004245?hl=en.

YouTube (privacy-enhanced mode, only after a click)

On this website we show videos from YouTube, such as customer testimonials and reference interviews. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

As long as you do not click "Play", no connection to YouTube is established; the preview image comes from our own server. Only when you click do we load the video via youtube-nocookie.com (privacy-enhanced mode). In particular, your IP address, the page visited and technical details of your browser are transmitted to YouTube; YouTube may also store information on your device. If you are logged in to Google, YouTube may assign the request to your account. We have no influence on the extent of this processing. Data may be transferred to Google LLC in the USA.

If you keep watching while scrolling or moving to another page, the same video continues in a small player at the edge of the screen. No new video is loaded; "Close" ends playback and the connection.

The legal basis is your consent, which you give by clicking "Play" after the notice below the video (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). More information: https://policies.google.com/privacy?hl=en.

Fonts (hosted locally)

This website uses the Archivo typeface. It is stored on our own server; no connection to Google Fonts or other font providers is made.

We link to other services, such as the kanbau application, the demo access demo.kanbau.com, kanlauf.com and our profiles on LinkedIn, Instagram and YouTube. These are simple links, not embedded plugins: data is only transmitted when you click the link. The linked services' own privacy notices apply.

7. kanlauf and AI features

kanlauf on this website

The kanlauf figure that accompanies you on the contact page, for example, is an animation that runs entirely in your browser. It reacts to which form field you are filling in, but does not send any input to us or to an AI service and does not store anything. There is no chat and no AI on this website that evaluates your input.

kanlauf and AI in kanbau

kanlauf is an optional AI agent that can be used in kanbau as a step in a workflow, for example to check incoming invoices, sort the mailbox or match bank transactions. kanlauf and the other AI features in kanbau (e.g. invoice recognition, AI analysis in the inbox, MCP interface) do not process data as part of this website, but within our customers' kanbau application. The following applies:

  • Role: The respective customer company is the controller for the data in kanbau. We process it as a processor on the basis of the data processing agreement with the customer.
  • Only once activated: AI support, invoice recognition and the MCP interface are extensions that the customer explicitly activates. Without activation, no data is sent to AI services.
  • User permissions: kanlauf and AI assistants connected via the MCP interface always work with the permissions of a specific user and only see what that user is allowed to see. They get no direct database access, only reviewed business functions. Deleting, archiving and bulk changes are excluded.
  • Your decision: AI results are suggestions. Only what a person has reviewed and approved is booked or changed.
  • AI services: For document recognition and AI features we use Google Cloud Document AI and Gemini from Google Ireland Limited as sub-processors. The relevant document contents and data are sent to Google, processed and returned to kanbau. Customers can also configure their own model from OpenAI, Azure, Anthropic or Google; data is then transferred to that provider on the customer's behalf.

Service providers in kanbau

To operate kanbau we use the following sub-processors as listed in the data processing agreement (Annex 3):

  • Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: server hosting, data centre and infrastructure. Processing location Germany.
  • CARBONEIO SAS (Carbone), 130 La Sauvagère, 85170 Bellevigny, France: generation of documents and print templates. Data is only processed transiently in memory; finished documents are deleted after download, at the latest after one hour. Templates are cached in encrypted form for a maximum of 365 days. Processing location France.
  • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland: Google Maps for address autocompletion, fonts, and Document AI and Gemini. Processing location EU and USA, safeguarded by EU standard contractual clauses and the EU-US Data Privacy Framework.
  • AC PM LLC (Postmark), 1 N Dearborn Street, Suite 500, Chicago, IL 60602, USA: sending system e-mails such as registration confirmations, notifications and password resets. Processing location USA, safeguarded by the EU-US Data Privacy Framework and additionally EU standard contractual clauses.

To retrieve bank transactions, customers can optionally use finAPI GmbH, Adams-Lehmann-Str. 44, 80797 Munich, Germany. They log in via the finAPI interface themselves and accept its terms of use.

Customers receive the data processing agreement including the technical and organisational measures on request; we are happy to answer questions about processing in kanbau through the usual contact channels.

8. Customer and contract data

We collect, process and use personal data only insofar as it is necessary for establishing, shaping or changing the contractual relationship (master data), for example when setting up demo access or concluding a contract for kanbau. This is based on Art. 6(1)(b) GDPR. The data is deleted after the order has been completed or the business relationship has ended. Statutory retention periods remain unaffected.

9. Applications

Handling of applicant data

You can apply to us via the application form on our careers page, by e-mail to job@kanbau.com, by post or via our job ads on the JOIN platform. We process the related personal data (e.g. contact and communication data, application documents, notes from interviews) insofar as this is necessary to decide on establishing an employment relationship. The legal basis is Art. 6(1)(b) GDPR in conjunction with Section 26 BDSG and – if you have given consent – Art. 6(1)(a) GDPR. Consent can be withdrawn at any time. Within our company, your data is only passed on to people involved in processing your application.

If your application is successful, the data submitted will be stored in our systems for the purpose of carrying out the employment relationship.

Application form on this website

In the application form you enter your name, e-mail address, optionally your phone number and a message, select the position and upload your documents as PDF (up to three files, 10 MB in total). The form can only be sent once you confirm that you have read this privacy policy.

Our server checks the details and files and forwards them by e-mail to our applications mailbox; neither details nor files are stored on the web server itself. You receive a confirmation with your name and the position to the e-mail address provided; it does not contain your message or documents. We send the forwarding to our applications mailbox and the confirmation via Postmark (AC PM LLC, see details above under "Contact form"). To prevent abuse, we briefly count how many applications come from an IP address; this counter is kept only in memory and applies for one hour at a time. The legal bases and retention described above apply.

Applications via JOIN

For job ads and managing applications we use JOIN, a service of JOIN Solutions AG, Eichenstrasse 2, 8808 Pfäffikon SZ, Switzerland. If you apply via JOIN, your details and documents are stored there and made available to us for processing. Switzerland is covered by an adequacy decision of the European Commission (Art. 45 GDPR). More information: https://join.com/privacy.

Retention period

If we cannot offer you a position, you decline an offer or withdraw your application, we keep the data submitted on the basis of our legitimate interest (Art. 6(1)(f) GDPR) for up to 6 months after the end of the application process. The data is then deleted and physical documents destroyed. Retention serves in particular as evidence in the event of a legal dispute. If it is foreseeable that the data will be needed after this period (e.g. due to an impending or pending legal dispute), we only delete it once the purpose for further retention no longer applies.

Longer retention may also take place if you have consented (Art. 6(1)(a) GDPR) or statutory retention obligations prevent deletion.

Inclusion in the applicant pool

If we cannot offer you a position, we can include you in our applicant pool at your request to contact you about suitable vacancies. We keep the applicant pool in JOIN or internally in our own kanbau database or an internal spreadsheet. This is done solely on the basis of your express consent (Art. 6(1)(a) GDPR). Consent is voluntary, unrelated to the current application process and can be withdrawn at any time. We then delete the data from the applicant pool unless there are statutory reasons for retention. The data is deleted at the latest two years after consent was given.

Last updated: October 2026