Privacy Policy

We take the protection of your personal data seriously. This policy informs you pursuant to Art. 13/14 GDPR about processing when visiting and using saqura.de.

1. Controller

Representative in the EU (Art. 27 GDPR) and in Switzerland (FADP)

As the controller is established outside the EU/EEA (Japan), we have appointed a representative in the European Union pursuant to Art. 27 GDPR and a representative in Switzerland under the Swiss Federal Act on Data Protection (FADP). You may exercise your data-protection rights through our representative in your own country:

DataRep maintains contact points in all EU/EEA countries and in Switzerland; please always address postal inquiries to "DataRep" so they reach us. For questions about our products or services, please continue to contact us directly at support@kyototech.co.jp.

2. Hosting & data residency

This website is hosted on a server in Germany (Nuremberg) at Hetzner Online GmbH; processing therefore takes place within the EU (Art. 6(1)(f) GDPR).

3. Server log files

On access the server processes: IP address, date/time, requested resource, referrer, user agent — for technical delivery, security and abuse prevention (Art. 6(1)(f) GDPR); deletion/anonymisation generally after 14 days.

4. Cookies & local storage

Without your consent we use no tracking or marketing cookies. Only if you agree in the banner does the Google tag set cookies for ad measurement (section 6). Your banner choice and your language and theme preferences are stored, where technically necessary, locally in your browser (localStorage) and do not leave your device (§ 25(2) TDDDG).

Currency of prices: We derive the currency in which we show prices from the region in the language setting your browser sends anyway (Accept-Language) and check it in your browser against the configured time zone. Your IP address is not evaluated for this and no external service is involved. For this we use two technically necessary cookies (§ 25(2) no. 2 TDDDG): saqura_currency stores your own currency choice and is set only when you change the currency yourself; saqura_currency_tz is set only when your time zone points to a different currency than the one shown and you have not made a choice of your own. Both contain only a currency code (e.g. eur), are not used for tracking and are not shared with third parties. saqura_currency lasts 365 days; saqura_currency_tz is a session cookie and is deleted when you close your browser.

YouTube videos (home page): The KyotoTech clip on the home page stage loads only when you click play. Before that we show a preview image from our own server and no connection to YouTube is made. The click loads the player in privacy-enhanced mode from youtube-nocookie.com. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google then receives in particular your IP address, browser and device details and the address of our page, and may store information in your browser. The legal basis is your consent given by the click (Art. 6(1)(a) GDPR, § 25(1) TDDDG); transfers to the USA rely on the EU-US Data Privacy Framework (Art. 45 GDPR). The Google Privacy Policy applies.

5. Analytics (Umami)

We use Umami, a self-hosted, cookieless analytics tool on our server in Germany. No cookies, no transfer to third parties; only aggregated, non-identifying data is collected (page, referrer, approximate country, browser/device); IP addresses are not stored persistently (Art. 6(1)(f) GDPR).

6. Google Ads and Google tag (conversion measurement)

Only with your consent do we embed the Google tag (gtag.js) of Google Ads. For users in the EEA and Switzerland the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; otherwise Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The purpose is conversion measurement: we learn whether a visit via one of our Google ads led to an enquiry through the contact form. Google does not receive the content of your enquiry.

Data processed includes in particular cookie identifiers, IP address, browser and device information, pages visited, the ad click identifier and the time and type of the conversion. Google processes this data as an independent controller (Google Ads Controller-Controller Data Protection Terms).

The legal basis is your consent (Art. 6(1)(a) GDPR; for storing and accessing information on your device § 25(1) TDDDG). Without consent the Google tag is not loaded; all consent types default to denied (Google Consent Mode). You can withdraw your consent at any time with effect for the future via “Cookie settings” in the page footer (Art. 7(3) GDPR).

Transfer to the USA: Data may be transferred to Google LLC in the USA. The basis is the European Commission’s adequacy decision (EU) 2023/1795 on the EU-US Data Privacy Framework (Art. 45 GDPR); Google LLC is certified under it.

Retention: cookies of this website (e.g. _gcl_au) up to 90 days; cookies on Google domains (e.g. IDE on doubleclick.net) up to 13 months in the EEA and the UK, otherwise up to 24 months. Your banner choice stays stored in your browser until you change or delete it. The Google Privacy Policy applies; on cookies see Google: cookies used in advertising products.

7. Payments (Stripe)

Purchases are processed via Stripe (Stripe Payments Europe, Ltd., Ireland / Stripe, Inc., USA). Name, email, billing and payment data are processed to perform the contract (Art. 6(1)(b) GDPR); you enter payment data directly with Stripe. Transfers to the USA rely on the EU Standard Contractual Clauses. The Stripe Privacy Policy applies.

8. Subscription / licence management

To provide licences/API keys we process your email and contract-related data in our billing system (Art. 6(1)(b) GDPR).

SaQura CertWatch — licence self-renewal: If self-renewal is switched on in the program (the default), your installation, in all licensed plans, asks license.kyototech.co.jp once a day whether a renewed, changed or revoked licence is available. It transmits the product identifier, a checksum of the licence number, the issue date of the installed licence and your preference for licence e-mails — no addresses, no results, no reports. In trial mode the program does not ask. The legal basis is contract performance (Art. 6(1)(b) GDPR). You can switch the query off in the program; you then receive the licence file by e-mail. Independently of this, the program fetches a version file from saqura.de once a day (only the current version number, no data of yours; can be disabled). For details on the connections of the product see the product privacy notice for CertWatch and the CertWatch Agent privacy notice.

SaQura CertWatch with automatic renewal: The connections to the certificate authority and to the DNS provider are made by your own CertWatch instance, not by KyotoTech. The agent on the target server connects only to your own instance. For details see the privacy notices mentioned above.

9. Crypto API (no-log)

The cryptographic operations and the storage of the associated metadata take place on a server in Germany (Nuremberg) at Hetzner Online GmbH — i.e. within the EU. Cryptographic payloads (plaintext/keys) are neither logged nor stored persistently (processed only transiently in memory). Metadata (e.g. key identifier, timestamp, associated customer email) is stored (Art. 6(1)(b)/(f) GDPR).

10. Contacting us

If you contact us via the contact form or by email, we process your data (name, email, subject, message) to handle the request (Art. 6(1)(b)/(f) GDPR).

To protect the contact form against spam and automated requests we use Cloudflare Turnstile (Cloudflare, Inc., USA) — a cookieless, privacy-friendly CAPTCHA. It evaluates technical data (incl. IP address and browser/device signals) to distinguish human from automated access (Art. 6(1)(f) GDPR; legitimate interest in abuse prevention). Transfers to the USA rely on the EU Standard Contractual Clauses. The Cloudflare Privacy Policy applies.

The contact page also links to WhatsApp (WhatsApp Ireland Limited, Ireland). The link does not load any content from WhatsApp. Only when you click it and message or call us there does WhatsApp process your data (incl. phone number, profile details and connection data) under its own responsibility; data may also be transferred to the USA. We process your message to handle the request (Art. 6(1)(b)/(f) GDPR). The WhatsApp Privacy Policy applies.

11. International data transfers

Website hosting, analytics and the Crypto API are operated in Germany (EU). The controller (company) and the billing/licence administration are based in Japan; an EU Commission adequacy decision (2019) exists for transfers to Japan. Transfers to Stripe third countries rely on Standard Contractual Clauses. For the Google tag (only with consent), transfers to the USA rely on the EU-US Data Privacy Framework (section 6).

12. Retention

We store data only as long as necessary for the stated purposes or required by law (commercial/tax).

13. Your rights

• Access (Art. 15), rectification (Art. 16), erasure (Art. 17)
• Restriction (Art. 18), portability (Art. 20), objection (Art. 21)
• Withdrawal of consent (Art. 7(3)), complaint to a supervisory authority (Art. 77)

To exercise these, an email to support@kyototech.co.jp suffices.

14. Data security

We implement technical and organisational measures according to the state of the art (TLS, hardened server in Germany, access restrictions).

15. KyotoTech app (iOS)

The KyotoTech app collects no data without your consent.

• Anonymous usage statistics and error reports are opt-in (on first launch, or under "More → Diagnostics") and can be turned off at any time (Art. 6(1)(a) GDPR). Statistics use a random session ID with no personal reference; error reports contain technical data only, never content.
• Contact requests sent from the app (topic, message, email address) are used solely to reply to you (Art. 6(1)(b)/(f) GDPR).
• Playing films loads the stream from our servers in Germany, which produces the usual technical access data (section 3). Links to YouTube, LinkedIn, Facebook, X, or the App Store open external services with their own privacy terms.

16. SaQura CertWatch (iOS app)

The app checks certificates from your device. The connection goes straight to the server whose address you type; it does not pass through us. Your watch list, notes, tags, grade history and the event log stay on your device.

• iCloud sync (opt-in): if you switch it on under “More → Settings”, the app stores your watch list (addresses, notes, tags and grade history) in the private iCloud database of your Apple Account (CloudKit container iCloud.jp.co.kyototech.certwatch) and syncs it with your devices that use the same Apple Account. That database belongs to your Apple Account and is operated by Apple under the terms of that account. There is no account with us, and we run no server for this data. The webhook address and the event log are not synced; they stay on the device. Switched off, everything stays on the device only. Legal basis: your consent (Art. 6(1)(a) GDPR), withdrawn by switching it off.
• Error report (opt-in): only if you agree in the settings and then tap “Send now” is a report transmitted to saqura.de/app/log. You see it in full beforehand. It contains error lines from the event log, the device model, the iOS and app version and, if you switch “Redact addresses” off, the checked address. Redaction is on by default. It does not contain your watch list, your notes or purchase data. Legal basis: your consent (Art. 6(1)(a) GDPR).
• Webhook alerts (CertWatch Pro, opt-in): the app calls an https address that you enter yourself. The recipient is the server you name, not us; the address is not synced and is not transmitted to us.
• Purchases and subscriptions are handled by Apple through your Apple Account. We receive no payment data; Apple provides us with financial reports that contain no personal data.
• The app contains no analytics or advertising libraries, sets no advertising identifier and performs no tracking within the meaning of Art. 4(4) GDPR.