Privacy policy

Version of 22 September 2026

1. Controller

The controller for the processing of personal data on this website within the meaning of the General Data Protection Regulation is:

KEG EXCHANGE GROUP Sp. z o.o.
ul. Domaniewska 44
02-672 Warsaw, Poland
Telephone: +48 59 857-04-10
Email: info@keg-exchange.com
NIP: 6692522969 · KRS: 0000531325

The sales office in Germany is Keg Exchange GmbH, Am Sammetshain 53, 57078 Siegen. You may address your request to either office; the controller within the meaning of the Regulation remains KEG EXCHANGE GROUP Sp. z o.o.

We have not appointed an external data protection officer. For questions about data protection and for exercising your rights, please contact the company directly: info@keg-exchange.com.

2. In short

This website gets by with very little data processing. It sets no cookies, uses no analytics tools and no advertising networks, and it loads nothing from other servers: fonts, images and videos are held on our own server. Personal data therefore only arises where you give it to us yourself — through the contact form or the newsletter sign-up — and in the technically unavoidable access data of the server.

3. Visiting the site and server log files

When you open a page, your browser transmits technical data that the server records: IP address, date and time, the file requested, the volume of data transferred, the status message, the page visited before (referrer), and the browser type and operating system.

This processing is necessary to deliver the page, keep the service stable and detect attacks. The legal basis is our legitimate interest in a secure and functioning offering, Art. 6(1)(f) GDPR.

The website runs on a managed server identified as hd-059.stpl.net.pl, administered through the DirectAdmin interface. The server is located in a data centre of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Where personal data is processed on our behalf in the course of this, it is done on the basis of a processing agreement under Art. 28 GDPR.

The log files are rotated and deleted automatically by the system. This data is not combined with other sources, and it is not evaluated for advertising or analytics purposes.

4. Cookies and local storage in the browser

This website sets no cookies. It stores two values in your browser's local storage:

• kx-theme — which colour scheme you chose, light or dark.
• kx-notice — whether you dismissed the storage notice.

Both values stay in your browser. They are not transmitted to us or to anyone else, they contain no identifier and they allow no conclusion about you as a person. You can delete them at any time in your browser settings; the site then works exactly as before and simply starts again in the default colour scheme. Because nothing is stored here for purposes beyond the display itself, and the storage serves the convenience you explicitly asked for, no consent is required.

5. Contact form and contact by email

If you write to us through a form on this website, we process the details you enter — usually your name, email address, possibly company and telephone number, and the text of your message — in order to answer your enquiry. The same applies to a message you send us directly by email.

The legal basis is the consent you give explicitly in the form, Art. 6(1)(a) GDPR; where your enquiry concerns the initiation or performance of a contract, additionally Art. 6(1)(b) GDPR. You may withdraw your consent at any time with effect for the future, informally, using the contact details above. This does not affect the lawfulness of processing carried out before the withdrawal.

We keep your enquiry for as long as it takes to deal with it and with any follow-up questions. After that we delete it, unless a commercial or tax retention obligation stands in the way.

6. Newsletter

For the newsletter we need your email address. Sign-up uses the double opt-in procedure: after submitting, you receive an email with a confirmation link, and only that click enters you on the list. This is how we show that the sign-up came from you. For that purpose we record the time of sign-up and of confirmation.

The legal basis is your consent, Art. 6(1)(a) GDPR. You can withdraw it at any time — via the unsubscribe link in every issue or informally to us. After withdrawal we remove your address from the distribution list; we keep the record of the earlier consent for as long as that is necessary to defend against possible claims.

We handle the sending through Brevo, a service of Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany, registered at the Charlottenburg local court under HRB 133191, a subsidiary of Sendinblue SAS, 17 rue de Salneuve, 75017 Paris, France. Your email address and the record of your sign-up are stored there and processed solely for sending our newsletter.

Brevo acts as a processor on our instructions, on the basis of a processing agreement under Art. 28 GDPR. The provider does not use your address for its own purposes, does not pass it on and does not sell it. According to the provider, processing takes place on servers within the European Union.

Measurement of the mailing. Brevo records whether an issue was opened and whether a link in it was clicked. For that, each email contains a small image file and the links are routed through a counting server. We use this to see which topics are being read and to weed out addresses that can no longer be reached. This measurement is part of the consent you give when signing up. It cannot be switched off separately – if you do not want it, please unsubscribe from the newsletter.

After a withdrawal we add your address to a suppression list so that you receive no further mailings. That storage serves this purpose alone; the legal basis is our legitimate interest under Art. 6(1)(f) GDPR.

The provider’s privacy information is available at brevo.com/legal/privacypolicy.

7. Fonts, images and videos

All fonts are held as files on our server and loaded from there. There is no connection to Google Fonts or to any other font service; your IP address is not transmitted to anyone outside our server. The same goes for images and videos: there is no content delivery network, no embedded video portals, and no map or social network buttons.

8. Links to other websites

In several places we link to offerings of our group of companies (keg-rental.de, aobaosi.de, our shop) and to third-party sources. These links are only followed when you click them. The operators of the target sites are responsible for the processing that takes place there; their privacy policies apply.

In the footer of every page we also link to our own profiles on Facebook, LinkedIn and Instagram. These are ordinary links with an icon served from our own server. No components of those networks are embedded, and nothing reaches them until you click.

9. Recipients of your data

We pass on your data only as far as it is needed for the respective purpose. This may involve: the hosting company that runs the website, the dispatch service for the newsletter, the office within our group responsible for your enquiry, and authorities and courts where we are legally obliged to do so. With service providers that process data on our behalf we conclude agreements under Art. 28 GDPR.

10. Transfers to third countries

No transfer to countries outside the European Union and the European Economic Area is envisaged. Should one take place in an individual case, it will only be on one of the bases provided for in Art. 44 et seq. GDPR.

11. Retention

We store personal data only for as long as it is needed for the respective purpose or a statutory retention period requires. After that it is deleted.

12. Your rights

You have the right to obtain information about the data we hold about you (Art. 15 GDPR), to have incorrect data corrected (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). Any consent given can be withdrawn at any time with effect for the future (Art. 7(3)).

A short message to info@keg-exchange.com is enough. So that we do not hand anyone another person's data, we have to verify your identity in a suitable way.

13. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Polish President of the Personal Data Protection Office: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland. Regardless of that, you may turn to the supervisory authority of your habitual residence or place of work (Art. 77 GDPR).

14. Provision of data, automated decisions

You are not obliged to give us personal data. Without the mandatory fields in the contact form, however, we cannot answer your enquiry, and without an email address we cannot send a newsletter. There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.

15. Changes to this policy

If the website changes or new services are added, we will adapt this policy. The version published here applies.