Privacy
Last updated: November 2026. See also: Legal notice. In case of doubt, the German version applies.
1. Controller
Mubariz Khawaja, trading as Kashmiri Labs
Genfer Str. 11
60437 Frankfurt am Main, Germany
Email: hello@kashmiri-labs.com
No data protection officer has been appointed.
2. Hosting and server log files
This privacy notice applies to the website www.kashmiri-labs.com and to the product page bestellsystem.kashmiri-labs.com. Both are operated by the same controller with the same host.
This website is hosted by ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. According to the provider, its servers are located in data centres in Germany. A data processing agreement under Art. 28 GDPR is concluded with the host.
When you visit the website or the product page, the host processes technically necessary connection data in server log files: IP address of the requesting device, date and time of access, requested file or URL, HTTP status code, amount of data transferred, referrer URL and information on browser, operating system and language. The purpose is to deliver the website and ensure its security and stability. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is the secure and functional operation of the website. According to ALL-INKL.COM's privacy information, log files are deleted after seven days at the latest; longer retention is possible in individual cases, for example in the event of attacks on its systems.
3. Contact form (project enquiries)
The contact form processes your name and email address (required) and, optionally, company, phone number, selected topics and project description; the time of receipt and a random reference ID are also stored. The purpose is to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry aims at a contract, otherwise Art. 6(1)(f) GDPR (interest in answering enquiries).
The enquiry is stored in a file in a non-public directory on the web space. A notification is sent to hello@kashmiri-labs.com and a confirmation of receipt to the email address you provided. If the notification fails, the enquiry remains stored and is handled from there. A hidden form field is used to block automated submissions.
4. Appointment booking
Booking an appointment requires the selected time slot, name, email address, customer type, at least one topic and acknowledgement of this privacy notice; company, phone number, project URL and message are optional. Language, time of booking and a random reference ID are also stored. The purpose is scheduling, avoiding double bookings and preparing the meeting. The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps at your request).
The booking is stored in a file in a non-public directory on the web space. You receive a confirmation email; the operator receives a notification at hello@kashmiri-labs.com. When available slots are queried, only free time slots are returned, never data of other people who booked.
5. Email communication
When you contact us by email or notifications and confirmations are sent, sender and recipient address, time, subject and content are processed. Emails are sent via the mail servers of ALL-INKL.COM and stored in the mailbox hello@kashmiri-labs.com; emails to you also involve your own email provider. The legal basis is Art. 6(1)(b) or (f) GDPR. Correspondence that is no longer needed is deleted regularly unless statutory retention obligations apply.
6. Abuse protection (rate limit)
For every request to the form and booking interface, a non-reversible hash of your IP address (SHA-256 with a secret salt) is stored together with a timestamp in a non-public file to limit automated abuse and mass sending. The plain IP address is not stored for this purpose. Entries are deleted after 24 hours at the latest. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is protecting the website and recipients from abuse.
7. Retention and deletion
Project enquiries are automatically deleted from the website's data store 180 days after receipt, bookings 180 days after the appointment. Clean-up runs on every call to the form or booking interface. Documents belonging to a contract or a tax-relevant transaction are transferred beforehand to the business records and kept there only for statutory retention periods (in particular Section 257 HGB, Section 147 AO). Rate-limit entries are deleted after 24 hours at the latest, server log files as described in section 2. Data may remain in the host's backups until the respective backup cycle expires.
8. Local fonts and Three.js, no cookies
Fonts and the Three.js library are served directly from this website; no data is transferred to third parties for this. This also applies to the product page bestellsystem.kashmiri-labs.com, which uses no scripts and no web storage. The live demo, contact form and booking linked from it are located on www.kashmiri-labs.com. No cookies, analytics or tracking services and no external CAPTCHAs are used. Web storage is only used by the live demo at /demo/metzgerei/ if you open it yourself: the demo keeps its fictional sample data and your entries in your browser's local storage (localStorage and sessionStorage) so that it works without a server. This data does not leave your device and is not transmitted to us. You can delete it at any time via “Zurücksetzen” (reset) in the demo or in your browser settings. The legal basis is Section 25(2) No. 2 TDDDG, as this storage is strictly necessary for the demo you requested. External links are only loaded after you click them; the privacy policy of the respective provider then applies.
9. Recipients and third countries
Recipients of personal data are ALL-INKL.COM as processor for hosting and email and, for emails to you, your own email provider. The website itself does not transfer data to countries outside the EU/EEA.
10. Obligation to provide data
Providing your data is neither legally nor contractually required. Without the fields marked as required, however, your enquiry or booking cannot be processed. All other information is voluntary.
11. No automated decision-making
No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.
12. Your rights
Subject to the GDPR, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Please contact hello@kashmiri-labs.com or the postal address above.
Right to object (Art. 21 GDPR): Where processing is based on Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. The data will then no longer be processed unless there are compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.
Right to lodge a complaint (Art. 77 GDPR): You may lodge a complaint with a data protection supervisory authority. The authority responsible for the controller is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (Hessian Commissioner for Data Protection and Freedom of Information), Wilhelmstraße 7, 65185 Wiesbaden, Germany, phone +49 611 1408-0, email poststelle@datenschutz.hessen.de, datenschutz.hessen.de.