Privacy Policy for KAEMI Data Swap

1. Controller and data protection officer

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

KAEMI GmbH
Glogauer Str. 5
10999 Berlin
Germany

Phone: +49 30 3642 878-0
Fax: +49 30 3642 878-99
Email: info@kaemi.email

Please address privacy enquiries in writing to the address above or by email to datenschutz@kaemi.email.

Our data protection officer: Samir Omar, c/o KAEMI GmbH, Glogauer Str. 5, 10999 Berlin, email datenschutz@kaemi.email.

2. What Data Swap is

Data Swap is a service operated by KAEMI GmbH for handing over files securely to customers, partners and staff. A signed-in sender uploads up to 5.00 GB per transfer, chooses a validity of 1 to 14 days and receives a download link to pass on, or lets us email it to the recipients entered. Recipients download without an account. Files and metadata are removed after expiry, on request right after the first complete download, or when the sender deletes the transfer.

The service is aimed at businesses and their contacts. It is not intended for children.

3. Hosting and processing on our behalf (Cloudflare)

Data Swap runs entirely on the edge platform of Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA) and is delivered via Cloudflare Workers. We use the following Cloudflare services:

• Cloudflare R2 (file storage) with the “Jurisdiction EU” restriction: Cloudflare guarantees that uploaded files are stored and processed exclusively within the European Union. Files are encrypted at rest.
• Cloudflare D1 (database) for transfer metadata, recipient addresses, password hashes and logs, set up in the Western Europe region.
• Cloudflare Access for signing in senders (section 4).
• Cloudflare Email Service for our notifications (section 8).

Individual requests (TLS termination, running the Worker, streaming files through) are handled in the Cloudflare data centre closest to the person – usually within the EU for EU visitors, possibly in third countries for visitors from elsewhere. Files themselves are stored in the EU only.

With every request Cloudflare processes technically necessary access data (IP address, date and time, requested URL, user agent, referrer) to deliver the service and fend off attacks (bot mitigation, DDoS protection, web application firewall). The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). This access data and the Worker's technical operating logs are kept for a maximum of 30 days and may be stored without location restriction in Cloudflare's central data centres worldwide.

We have a data processing agreement (DPA) with Cloudflare including EU Standard Contractual Clauses (SCC) to safeguard any data flows outside the European Economic Area. Cloudflare, Inc. is also certified under the EU-US Data Privacy Framework (DPF). Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/.

4. Sign-in via Cloudflare Access

Only signed-in users can send files. Sign-in is handled by Cloudflare Access (Zero Trust) on the protected area /app:

• KAEMI staff sign in with their company account via single sign-on (Microsoft Entra ID or SAML); your business email address is passed to Access.
• External senders enter their email address and receive a one-time code by email from Cloudflare Access (sender noreply@notify.cloudflare.com). Email address, time, IP address and user agent of the sign-in attempt are processed.

After a successful sign-in, Access issues a signed session token (cookie CF_Authorization, valid for 24 hours). Data Swap reads only your email address from it, to assign transfers to you and to show it to recipients as the sender. Sign-in events are logged by Cloudflare Access (time, email address, IP address, result) and retained there according to the retention of Cloudflare Zero Trust logs.

Legal basis: Art. 6(1)(b) GDPR (providing the service you wish to use) and our legitimate interest in access control and traceability of who sent files (Art. 6(1)(f) GDPR).

5. Sending files (senders)

When you create a transfer we process:

• your email address (from sign-in) as sender address,
• the recipient addresses you enter (optional),
• title and message (optional),
• the uploaded files including file names, sizes and types,
• the chosen validity, the “delete after first download” option and – if set – a password, stored solely as a cryptographic hash (PBKDF2-SHA256),
• your language choice for notifications,
• time, IP address, country and browser when creating and finalising the transfer (event log, section 7).

We do not open, analyse or otherwise use the contents of your files; we only check size and completeness of the upload. You remain responsible for the contents you hand over – only share data you are entitled to share.

Legal basis: Art. 6(1)(b) GDPR (providing the service). Where you enter third parties' personal data in files or as recipient addresses, processing is based on our and your legitimate interest in a secure handover (Art. 6(1)(f) GDPR).

Under “My transfers” you can see your active transfers, delete them at any time and view the download log.

6. Receiving files (recipients)

If a sender enters your email address, we send you a notification with download link, sender address, message and the number and total size of the files (section 8). File names are not included in the email; they are shown on the download page only. No account is needed to download; the link contains a random, unguessable identifier. If the transfer is password-protected you enter the password the sender gives you separately; after a correct entry we set an unlock cookie (section 9).

When a file or the ZIP archive is downloaded completely, we store the time, the file downloaded, your IP address, the country and city determined by Cloudflare, and your user agent (browser and operating system). This information is visible to the sender in the download log of their transfer and is emailed to them on the first download. Failed password attempts are also logged with IP address.

The purpose is proof of delivery for the sender, abuse detection (e.g. automated link scanners, password guessing) and the security of the service. Legal basis: Art. 6(1)(f) GDPR. The download page points out this logging.

7. Download and event log

We keep two logs:

• The download log of a transfer (time, file, IP address, origin, browser) is visible to the respective sender and is deleted together with the transfer.
• The event log for operations additionally records creation and completion of transfers, deletions, expiry, password attempts and detected scanner requests – each with sender address, transfer, time, IP address, country and user agent. Only named administrators of KAEMI GmbH can access it via an area protected by Cloudflare Access. Entries are deleted automatically after 90 days.

Legal basis: our legitimate interest in security, abuse prevention, troubleshooting and traceability (Art. 6(1)(f) GDPR).

8. Email notifications

Data Swap sends transactional emails only – no advertising, no newsletter:

• to entered recipients: download link, sender address, title, message, number and total size of the files (no file names), validity and notes on password protection or deletion after download;
• to the sender: a notice on the first complete download with the log data of that download (section 6).

Emails are sent via Cloudflare Email Service from noreply@kaemi.app; for recipient emails the reply-to address is the sender's, so replies reach them directly. Cloudflare processes recipient address and message content on our behalf (section 3). One-time-code emails for sign-in are not sent by us but by Cloudflare Access (section 4).

9. Cookies and local storage

Data Swap uses strictly necessary cookies only (§ 25(2) no. 2 TDDDG); no consent is required. There are no statistics, analytics or marketing cookies and no tracking.

When installed as a web app, the browser additionally registers a service worker that caches only immutable design assets (fonts, logo, icons). It processes no personal data.

10. Retention and deletion

• Files and transfer metadata (including recipient addresses, title, message, password hash, download log) are deleted once the validity chosen by the sender (1 to 14 days) has expired, the sender deletes the transfer or – if enabled – all files have been downloaded completely once. An hourly clean-up job removes expired transfers from storage and database.
• Incomplete uploads (aborted transfers, unfinished drafts) are deleted after two days at the latest.
• Event log: 90 days.
• Access data and operating logs at Cloudflare: a maximum of 30 days; Cloudflare Access sign-in logs according to Zero Trust log retention.
• Emails sent are subject to the retention of the receiving mailbox; we keep no copies.

11. Security (Art. 32 GDPR)

As an IT security company we protect personal data with state-of-the-art technical and organisational measures. For Data Swap these include in particular:

• transport encryption with TLS (incl. TLS 1.3) for all connections, post-quantum key agreement via the Cloudflare edge, and HSTS
• encryption at rest in Cloudflare R2 and D1; file storage with guaranteed EU location
• access control for senders via Cloudflare Access (Zero Trust) with SSO or one-time code; administration area for named persons only
• download links with random identifiers (about 79 bits of entropy), optional password protection with salted PBKDF2 hashes, rate limits on password and request attempts
• files are delivered strictly as download attachments with a restrictive Content Security Policy – never rendered in the browser
• Cloudflare Web Application Firewall (WAF), DDoS protection and bot management
• automatic deletion concept (expiry, delete after download, clean-up of incomplete uploads), monitoring and logging of security-relevant events

Further information on our security measures, certifications and sub-processors is available in our Trust Center (trustcenter.kaemi.website).

12. Recipients of data and third-country transfers

• Cloudflare, Inc. (USA) as processor for hosting, storage, sign-in and email delivery – under a DPA with EU Standard Contractual Clauses; additionally DPF-certified. Files are stored in the EU only (section 3).
• Recipients of a transfer receive the sender's email address, their message and the files. Senders receive the log data of downloads (section 6).
• Named administrators of KAEMI GmbH have access to the event log (section 7).

No further disclosure to third parties takes place unless we are legally obliged. There is no automated decision-making or profiling.

13. Your rights

You have the following rights regarding your personal data at any time:

• right of access (Art. 15 GDPR)
• right to rectification or erasure (Art. 16, 17 GDPR)
• right to restriction of processing (Art. 18 GDPR)
• right to data portability (Art. 20 GDPR)
• right to object to processing (Art. 21 GDPR)

To exercise your rights, contact us informally – by email to datenschutz@kaemi.email, by post to the address in section 1, or via the request portal in the KAEMI Trust Center. We confirm receipt within one week and respond within one month at the latest. To protect your data we may ask for proof of identity for access or other data-subject requests – only where necessary and where there are reasonable doubts.

Right to object (Art. 21 GDPR): Where we process personal data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time on grounds relating to your particular situation. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

As a recipient you can also contact the sender directly, who can delete a transfer at any time.

14. Right to lodge a complaint

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR. The competent authority for KAEMI GmbH is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59-61
10555 Berlin, Germany
https://www.datenschutz-berlin.de/

15. Changes to this privacy policy

We update this policy when the service, the processors used or the legal situation change. The version published here applies; the date of the last update is shown above.