1. Who we are
Kern is operated by Kern Technologies GmbH, Musterstrasse 1, 10115 Berlin, Germany. We are the data controller for all personal data processed through the kern.app platform and marketing website.
2. What data we collect
- Account data: name, email address, company name, job title.
- Employee HR data: entered by TENANT_ADMIN on behalf of their organisation, stored in your tenant's isolated data partition.
- Usage data: pages visited, features used, browser type, IP address - used only for product improvement and security.
- Payment data: processed by Stripe. We do not store card numbers.
3. Legal basis for processing (DSGVO Art. 6)
- Contract performance (Art. 6(1)(b)): to provide the Kern platform you subscribed to.
- Legitimate interests (Art. 6(1)(f)): security monitoring, fraud prevention, product analytics.
- Consent (Art. 6(1)(a)): marketing emails - opt out any time.
- Legal obligation (Art. 6(1)(c)): tax records, compliance audit logs.
4. How we use your data
- Operate and improve the Kern platform.
- Send transactional emails (account creation, password reset).
- Send product updates and newsletters (with consent, opt-out any time).
- Provide customer support.
- Comply with legal obligations (tax, audit).
5. Data sharing
We do not sell your data. We share it only with: (a) Supabase (database hosting, EU region), (b) Stripe (payment processing), (c) Vercel (infrastructure hosting, EU region), and (d) authorities where legally required. All sub-processors are GDPR-compliant and covered by Data Processing Agreements.
6. Data retention
Active account data is retained for the duration of your subscription plus 12 months. Job application data is deleted after 6 months if the applicant is not hired. You may request deletion at any time under Art. 17 DSGVO.
7. Your rights (DSGVO Art. 15-22)
- Art. 15 - Right of access: receive a copy of your personal data.
- Art. 16 - Right to rectification: correct inaccurate data.
- Art. 17 - Right to erasure: delete your account and data.
- Art. 20 - Data portability: export your data in machine-readable format.
- Art. 21 - Right to object: opt out of processing based on legitimate interests.
8. Cookies
We use strictly necessary session cookies for authentication and optional analytics cookies (with consent). See our Cookie Policy for details.
9. Security
Sensitive HR data (IBAN, tax ID, SV-Nummer) is stored encrypted at rest. All data is transmitted over TLS 1.3. Access is role-gated at every layer. We conduct regular security reviews.
10. Contact & DPO
To exercise your rights or for data protection queries, contact: legal@kern.app. Our Data Protection Officer can be reached at dpo@kern.app.