01 What this policy covers
This policy covers kommandhub.com — the public website you are reading now. It explains what personal data the site processes, why, for how long, and who else receives it.
It does not cover the systems we build and operate for clients. When we work on a client's store or application we act as a processor on that client's instructions, and their own privacy notice governs the data in it. See "Client systems" below.
02 Who is responsible
KommandHub is the controller for the personal data described here. You can reach us about anything in this policy at info@kommandhub.com, or by post at the address in our legal notice.
03 What this site does not do
It is worth stating plainly, because a lot of privacy policies imply otherwise:
- There are no user accounts. You cannot register, log in, or set a password. The account routes are closed and return a not-found response.
- There is no payment processing. No card details are collected anywhere on this site.
- There is no analytics, no tag manager, no pixel, and no advertising or profiling technology of any kind.
- We do not sell, rent or share personal data for anyone else's marketing.
- There is no cross-site tracking, and nothing on this site follows you to another one.
Because the site sets nothing but strictly necessary cookies, there is no consent banner to click through. That is a consequence of not tracking you, not an oversight.
04 What we process when you only read
Simply loading a page causes our server to process a small amount of technical data. This is unavoidable for any website: the server cannot send you a page without knowing where to send it.
- Server and application logs
- Your IP address, the page requested, the time, the HTTP status, your browser's user-agent string and, where your browser sends one, the referring page. Used to keep the site running, diagnose faults, and detect abuse.
- Rate limiting
- The public forms are throttled per IP address. Your IP is held in a short-lived counter to enforce that limit. Without it, the forms are an open relay for spam.
- Language and locale
- The language you are reading is part of the URL (/en, /de, /fr). Nothing is stored about it.
Legal basis: our legitimate interest in operating a secure, functioning website (GDPR Article 6(1)(f); NDPA 2023 section 25(1)(f)).
05 What we process when you use a form
There are three forms on this site. Each one is listed below with exactly what it takes, where it goes and why we are allowed to process it.
| Form | What it collects | What happens to it | Legal basis |
|---|---|---|---|
| Contact form | Your name, email address, the subject you pick, and your message. | Sent to us by email and kept in that mailbox. The name, email and subject — not the message body — are also written to our mail log, along with the delivery record for that message. | Steps prior to entering a contract at your request (Art. 6(1)(b)), or our legitimate interest in answering enquiries (Art. 6(1)(f)). |
| Newsletter | Your email address and the time you subscribed. | Stored in our database until you ask to be removed. Also written to the application log. | Your consent (Art. 6(1)(a)), which you can withdraw at any time. |
| Product waiting list | Your email address and which product you asked about. | Sent to us by email. It is not added to any database. The address and the product are written to our mail log, along with the delivery record for that message. | Your consent (Art. 6(1)(a)), which you can withdraw at any time. |
Withdrawing consent. There is currently no one-click unsubscribe link. Email info@kommandhub.com and we will remove your address; we treat that as a deletion request and act on it without asking why.
Please do not send sensitive information through these forms. They are ordinary email underneath. Do not include health data, government identifiers, credentials, API keys or card numbers. If you need to send us something confidential, ask us first and we will arrange a secure channel.
06 Third parties your browser contacts directly
Some parts of the page are loaded by your browser from someone else's server. When that happens the third party receives your IP address and basic request information directly from you — we never see it, and we cannot prevent it once the page is loading. These are the only three.
| Service | Where it appears | What it receives | Their policy |
|---|---|---|---|
| Cloudflare Turnstile | The contact, newsletter and waiting-list forms. | Your IP address and signals about your browser and device, used to tell a person from a bot. We also send your IP address to Cloudflare from our own server when we verify the result. | Cloudflare privacy policy |
| Bunny Fonts | Every page — it serves the typeface. | Your IP address and user-agent when the font files are fetched. Bunny Fonts is used specifically because it is a GDPR-oriented alternative to Google Fonts. | Bunny privacy policy |
| OpenStreetMap | The map on the contact page only. | Your IP address and user-agent when the embedded map loads. | OpenStreetMap Foundation privacy policy |
Links elsewhere on this site — to GitHub, to the Shopware Store, to the tools we name on our about page — are ordinary links. Nothing is requested from those services until you click, and nothing is sent to them if you do not.
Legal basis: our legitimate interest in protecting the forms from automated abuse and in presenting the site as designed (Art. 6(1)(f)).
07 Third parties we pass data to
These are the providers that process personal data on our behalf, under contract and on our instructions.
Our website hosting and our email delivery are provided under contract by suppliers who process data only on our instructions and only to keep those two things running. Email info@kommandhub.com and we will tell you who they currently are and where they operate.
We do not disclose personal data to anyone else, except where we are legally required to — for example in response to a valid order from a court or a competent authority. If that ever happens we will tell you, unless we are prohibited from doing so.
08 How long we keep things
- Contact enquiries
- Kept for as long as the conversation is live, and then for up to 24 months in case you come back to us about the same thing. Enquiries that turn into a project are kept for the life of that engagement and for as long as we are required to retain business records afterwards.
- Newsletter subscriptions
- Until you ask to be removed. There is no expiry, and we do not re-add an address that has been removed.
- Waiting-list requests
- Until the product is released and we have told you, or until you ask us to drop it — whichever comes first.
- Server and application logs
- Rotated on a short cycle and not archived. They are for diagnosis, not for building a history of visitors.
- Mail delivery log
- Every message we send is recorded with its recipient, subject and the mail server's reply, so a message that never arrives can be traced. Kept for 14 days and then deleted. The content of your message is not recorded, and neither are our mail credentials.
- Rate-limit counters
- Minutes. They expire as soon as the window they are counting closes.
09 Where your data is processed
We are established in Nigeria and we work with clients and visitors in Europe and West Africa, so personal data may be processed in both places.
Where data moves out of the European Economic Area, we rely on the European Commission's Standard Contractual Clauses with the provider concerned. Where data moves out of Nigeria, we rely on the adequacy and contractual mechanisms permitted by the Nigeria Data Protection Act 2023. You can ask us for details of the safeguards that apply to a specific transfer.
10 Your rights
Depending on where you are, you have some or all of the following rights over the data we hold about you. They come from the GDPR if you are in the EEA or the UK, and from the Nigeria Data Protection Act 2023 if you are in Nigeria. In practice we apply them to everyone.
- Access
- Ask what we hold about you and get a copy of it.
- Rectification
- Have anything inaccurate corrected.
- Erasure
- Have it deleted, where we have no overriding obligation to keep it.
- Restriction
- Have us stop processing it while a dispute about it is resolved.
- Objection
- Object to processing we base on legitimate interest. For direct marketing this is absolute: say stop and we stop.
- Portability
- Receive the data you gave us in a machine-readable form, or have it sent to someone else.
- Withdraw consent
- Where we rely on your consent, withdraw it at any time. This does not undo processing that already happened.
To exercise any of these, email info@kommandhub.com. We will respond within one month. We do not charge for this, and we will not ask you to justify the request. If we need to confirm who you are before handing over data, we will ask for the minimum needed to do that and nothing more.
11 If you are not satisfied
Tell us first — most problems are a misunderstanding we can fix quickly. You do not have to, though, and you can complain to a regulator at any time:
- In Nigeria: the Nigeria Data Protection Commission.
- In the EEA: the supervisory authority in the country where you live, work, or where you think the problem happened. The European Data Protection Board lists them all.
- In the UK: the Information Commissioner's Office.
12 Client systems
Most of what we do is build and operate software for other organisations. In that work our client is the controller and we are a processor: we handle personal data in their systems only on their documented instructions, under a written data processing agreement, and we do not use it for our own purposes.
If you are a customer of one of our clients and you want to exercise a right over your data, contact that organisation. They are the ones who can act on it. If you contact us instead we will pass your request on and tell you we have done so, but we cannot decide it ourselves.
When we operate a system we keep access to it limited to the engineers who need it, and that access is logged. Our clients can ask us for the current list of people with access and the subprocessors involved in running their system.
13 If you apply for a job
Applications reach us through the same contact form, so the same handling applies: your message arrives as email and stays in that mailbox.
We keep applications for 12 months after the role is filled so we can come back to you if something similar opens up, and then delete them. Ask us to delete yours sooner and we will. We do not run automated screening, and no decision about an application is made by software.
Legal basis: steps prior to entering a contract of employment at your request (Art. 6(1)(b)), and our legitimate interest in keeping a short candidate record afterwards (Art. 6(1)(f)).
14 How we protect it
The site is served over HTTPS only. Session cookies are HTTP-only and same-site. Form submissions carry a CSRF token and pass a bot check before they are accepted, and each one is rate-limited per IP address. Access to the mailbox and the database is limited to the people who need it and protected by multi-factor authentication.
None of that makes a system unbreakable, and we would rather say so than claim otherwise. If you find a weakness, our security and disclosure policy explains how to report it and what we will do about it.
15 Children
This is a business-to-business site and it is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has sent us personal data, email info@kommandhub.com and we will delete it.
16 Changes to this policy
When what we do changes, this page changes with it, and the date at the top moves. Material changes — a new processor, a new purpose, a new category of data — are described here rather than folded in silently. Earlier versions are in the version history of the repository this site is built from, and we will provide a copy on request.