kahlholdings Services
Last updated: October 2026. This Privacy Policy explains how kahlholdings Services collects, uses, stores, and shares information when you visit kahlholdings.com, subscribe to updates, submit forms, or receive consumer service. We write this document for clients who want practical clarity, not hidden data practices.
1. Who we are
The data controller for this site is kahlholdings Services, operating at kahlholdings.com. Consumer service activities generate household profiles, visit notes, and product orders that we treat as sensitive operational records even when they do not meet legal definitions of special categories.
2. Information we collect
Information you provide
Contact and checkout forms collect names, email addresses, and message content. Subscribe and unsubscribe forms collect email addresses. Cart checkout may include delivery notes describing access instructions without requiring street identifiers on this static site.
Service and visit data
When you become a client, we store equipment details, serial numbers, maintenance history, photos you approve, warranty case numbers, and coordinator communications. This data supports repeat visits and advocacy.
Technical data
Standard server logs may capture IP addresses, browser types, and timestamps for security. The cart uses browser localStorage to hold product selections until checkout; that data stays on your device unless you submit a checkout form.
Cookies and similar technologies
We minimize cookies on this static site. If analytics or consent banners are added later, this section will list categories and retention. You can control browser storage for cart items by clearing site data.
3. How we use information
We use personal data to respond to inquiries, schedule and document consumer service, fulfill product requests, send newsletters you requested, improve training materials, prevent fraud, and comply with law. We do not sell personal information to data brokers.
Visit documentation helps technicians avoid repeating diagnostics. Advocacy records demonstrate timelines when manufacturers request proof. Aggregated, de-identified statistics may guide inventory decisions without naming clients.
4. Legal bases for processing
Where consent applies, such as marketing email, you may withdraw through unsubscribe without affecting lawful processing before withdrawal. Contract performance covers service delivery you request. Legitimate interests cover security logging, quality audits, and modest site improvements balanced against your rights. Legal obligations cover tax, safety, and regulatory requests when applicable.
5. Sharing and processors
We share data with field technicians, payment processors after manual checkout confirmation, delivery partners, and software vendors under contracts requiring confidentiality and purpose limits. Manufacturers receive only the details necessary for warranty claims you authorize.
Social share links do not transmit your data until you activate them; the destination platform’s policy then applies. We do not post your visit photos publicly without separate consent.
6. Retention
Marketing emails are retained until unsubscribe plus a short suppression window to prevent accidental re-adds. Contact form copies are kept for twenty-four months unless a service relationship continues. Service records remain for the relationship duration plus seven years for warranty and quality traceability unless law requires longer. Server logs rotate on a ninety-day cycle unless investigating incidents.
7. Security
We use access controls, encrypted transport for site delivery, and staff training on phishing and device hygiene. No method is perfect; report suspected breaches through the contact page. We will notify affected clients when required and describe remedial steps in plain language.
8. Your rights
Depending on location, you may request access, correction, deletion, restriction, portability, or objection to certain processing. Marketing can stop via unsubscribe. Service records needed for safety or legal claims may be retained despite deletion requests until obligations end.
Submit rights requests through contact us with enough detail to verify identity. We respond within statutory timelines and explain any denials with reasons.
9. Children
The site is not directed to children. We do not knowingly collect data from minors without guardian involvement tied to a household service request. Contact us to remove inadvertent submissions.
10. International transfers
If data moves across borders through cloud tools, we rely on appropriate safeguards such as standard contractual clauses or equivalent mechanisms required by applicable law. Copies of relevant summaries are available on request.
11. Automated decisions
We do not make solely automated decisions with legal or similarly significant effects. Scheduling suggestions may use rules-based software, but humans confirm appointments.
12. Third-party links
Linked social platforms and manufacturer sites have independent policies. Review them before submitting personal data there.
13. Changes to this policy
We update this page when practices change materially. Continued use after updates constitutes acknowledgment where permitted; for consent-based processing, we seek fresh consent when required.
14. Contact and complaints
Privacy questions go through the contact page. You may also lodge complaints with supervisory authorities where law provides that right. We prefer to resolve concerns directly and will document our response.
15. Data minimization in forms
We collect only fields shown on each form. Contact messages avoid requesting payment card numbers or government identifiers through the public site. If advocacy later requires proof of purchase, coordinators send secure upload instructions rather than expanding always-on form fields.
Optional fields remain optional. Required minimum lengths, such as ten characters in messages, reduce spam without forcing lengthy disclosures. Validation errors display inline and are not logged separately from successful submissions.
16. Incident response
Suspected unauthorized access triggers containment, credential rotation for affected tools, and client notification when personal data may have been exposed. Post-incident reviews update training scenarios for coordinators and technicians. Regulators receive reports when thresholds require them.
17. Consumer service-specific practices
Household profiles may note allergy alerts, pet behavior, or mobility accommodations you share so technicians prepare appropriately. You may edit or remove optional notes anytime through a coordinator. Warranty advocacy may require sharing purchase receipts you upload; we redact unrelated financial details before forwarding.
Training uses anonymized visit scenarios derived from real patterns. Identifiers are stripped unless you grant explicit permission for case studies. Product recommendations logged in your profile reflect your purchases and stated preferences, not opaque scoring.
Local cart storage is not synchronized across devices. Clearing browser data removes cart lines until you add products again. Checkout forms transmit only what you submit in that session.
We periodically audit vendor subprocessors for alignment with this policy. Audits review encryption practices, employee access logging, and deletion capabilities. Vendors who fail remediation timelines are replaced where feasible without disrupting active service engagements.
When you ask us to restrict processing, we flag profiles so coordinators see reduced sharing until the restriction lifts. Restrictions may delay advocacy where manufacturers require full history; we explain trade-offs before applying flags.
Research partnerships with academic groups use only de-identified datasets and require ethics review before we contribute visit statistics. No partnership grants direct access to live household profiles.
Employee devices accessing client notes must use encrypted storage and screen locks. Lost devices trigger remote wipe procedures and client notification when exposure risk exceeds internal thresholds documented in our security runbook.
Backup tapes, if used, rotate off-site with encryption and are destroyed at end-of-life through certified vendors who provide certificates of destruction upon request.
Privacy impact assessments precede major process changes such as new scheduling tools or expanded photo documentation, documenting risks and mitigations before rollout to field teams and client-facing portals.
Questions about this policy receive written answers suitable for printing when you need records for household or property files.