Privacy Policy & Privacy Center

1. Data Controller

The controller responsible for data processing on this website, in the platform and in the research database is:

For data protection enquiries, you can also reach us at privacy@kodo-leads.com.

2. Principles

We process personal data in accordance with the requirements of the General Data Protection Regulation (GDPR). We do not collect special categories of personal data within the meaning of Art. 9 GDPR, such as data on health, religion or political opinions.

3. Visiting the Website (Server Log Files)

When you access our website, our server automatically processes information that your browser transmits:

• type and version of the browser
• operating system used
• address accessed including parameters and previously visited page (referrer)
• IP address and date and time of access
• HTTP status code and amount of data transferred

We use this data only to deliver the website, to ensure its security and functionality and to fend off attacks; in the event of attacks, we may pass it on to law enforcement authorities. We do not combine it with other data. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and stable operation of the website. The logs are rotated daily and deleted after 52 days at the latest. IP addresses from which attacks originate are blocked automatically for 24 hours; we delete this block log after five weeks at the latest.

4. Customers and Users of the Platform

When you use the platform (Kodo CRM, Kodo assistant) as a customer or user, we process the data required for the contract:

• User account: name, email address, password (stored only as a non-reversible hash), the time the account was set up and the IP address at login. We set up accounts on the basis of a contract; there is no open registration.
• Use of the service: your search requests and target criteria, your profile (such as your offering and competitors), saved lists, notes and work status, exports and usage and billing data (such as credit balance). We evaluate free-text requests in the Kodo assistant using AI (section 6).
• Communication: emails we send you under the contract, such as login links and notifications.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract). For users whom a customer sets up for its team, the legal basis is additionally Art. 6(1)(f) GDPR; our legitimate interest lies in providing the accesses ordered by the customer.

5. Information for Persons in Our Research Database (Art. 14 GDPR)

This section is addressed to persons whose professional contact data we have collected in the course of our research without them being our customers themselves.

What we do: Kodo operates a B2B research platform. We record companies and their professional contact persons and provide this data to business customers for a fee for their B2B sales.

Which data we process:

• name and professional function
• business email address and business phone number
• address of a public profile on a professional network (LinkedIn)
• the associated company with company data
• our assessment of how well the professional function matches a customer's search
• where the data was found, the date of collection and the date of the last confirmation in the source

Where the data comes from:

• publicly accessible company websites, in particular legal notices (Impressum), team and contact pages
• commercial and company registers, public announcements, press releases and trade fair exhibitor directories
• search engine results
• profiles on professional networks (LinkedIn), which we retrieve via the service providers Apify and Scrapingdog
• the database of the provider Hunter.io, which according to its own statements collects business contact data from publicly accessible web pages

We can also derive business email addresses from a company's recognisable address pattern, for example firstname.lastname@company.com. Such addresses are not publicly listed; we label them as derived.

Purpose and legal basis: We process the data in order to provide companies with suitable professional contact persons for B2B sales. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest and that of our customers lies in initiating business relationships between companies and between companies and public institutions such as schools. We only process professional information related to your professional role and no private contact data. We regularly check the information against its source and delete outdated data (section 8).

Recipients: Our customers receive the data on the companies and institutions that match their target criteria, in the Kodo interface, as a file or via a partner interface. The partner with access to this interface is currently Jimmy UG (haftungsbeschränkt), Adrian-von-Riedl-Str. 34, 86669 Königsmoos, Germany (Jimmy Ausbildung), which uses it to retrieve data on schools and training companies. Upon provision, the recipients become independent controllers for the further processing and must inform you themselves at the latest when they first contact you. We list our service providers in section 6.

Notification: Notifying every person individually would involve a disproportionate effort, because our database comprises a very large number of people and the information comes exclusively from publicly accessible sources (Art. 14(5)(b) GDPR). We therefore make this information publicly available. Our customers inform you at the latest when they first contact you.

Automated evaluation: With AI support, we assess professional functions according to how well they match a customer's search. This assessment only determines the order of the contact persons. No automated decision with legal or similarly significant effect within the meaning of Art. 22 GDPR takes place.

Objection: You can object to the processing at any time without giving reasons, in the Privacy Center, via Remove data or by email to privacy@kodo-leads.com. Upon receipt, we permanently add your details to our suppression list. They will then neither be collected again nor delivered to customers. The suppression entry is exempt from the automatic deletion run so that your objection remains effective permanently.

6. Recipients and Service Providers

We use the following service providers. Where they process data on our behalf, data processing agreements under Art. 28 GDPR are in place. We base transfers to countries outside the European Economic Area on an adequacy decision of the EU Commission, in particular for recipients certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR), or on the standard contractual clauses of the EU Commission (Art. 46(2)(c) GDPR).

7. Cookies, Local Storage and Third-Party Content

We only use technically necessary cookies on our website. We currently do not use any analytics, statistics or marketing services.

Technically necessary cookies (always active):

• “kodo-leads-session” maintains your session, such as your login and the selected language. The cookie is only transmitted in encrypted form and cannot be read by scripts. Storage period: 200 hours.
• “XSRF-TOKEN” protects forms against cross-site request forgery. The cookie is only transmitted in encrypted form. Storage period: 200 hours.
• “remember_web_…” is only set if you choose “Remember me” when logging in and keeps you logged in. Storage period: around 400 days or until you log out.

Legal basis: Section 25(2) no. 2 TDDDG (strictly necessary) and Art. 6(1)(f) GDPR; our legitimate interest lies in the secure operation of the website.

Cookie banner and your choice: On your first visit to a page where we could load services requiring consent, a banner asks whether you allow the “Statistics” and “Marketing” categories in addition to the necessary cookies. We store your choice in your browser's local storage (localStorage, entry “kodo_cookie_consent_v1” with the selected categories and the time). After twelve months we ask again. The entry is not transmitted to our server. You can change or withdraw your choice at any time: Reopen cookie settings. Legal basis: Section 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR.

Google Tag Manager: Only when you allow “Statistics” or “Marketing” does your browser load Google Tag Manager from Google Ireland Limited. In doing so, it transmits your IP address, information about your browser and device and the page accessed to Google. No analytics or advertising services are currently set up via the Tag Manager; it does not set any cookies itself. In addition, Google Consent Mode is preset: without your consent, analytics and advertising storage remain blocked. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future. If we set up statistics or marketing services in the future, we will update this policy beforehand.

Content from third-party servers: Some pages load content from third-party servers; for technical reasons, the respective provider receives your IP address and information about your browser:

• the “Listed on European Tech Map” badge in the footer, loaded from europeantechmap.eu (delivered via Cloudflare),
• in the logged-in customer area, fonts from Google Fonts (Google) and fonts.bunny.net (BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia),
• on shared report links, program libraries from cdn.jsdelivr.net (delivered via Cloudflare and Fastly) and cdn.tailwindcss.com (Tailwind Labs, delivered via Vercel in the USA) and fonts from Google Fonts and fonts.bunny.net; your IP address may reach the USA in the process.

Legal basis: Art. 6(1)(f) GDPR; our legitimate interest lies in the consistent and functional presentation of the pages. The fonts of the public website are hosted on our own server.

8. Storage Period and Deletion

We only store personal data for as long as is necessary for the stated purposes or as statutory retention obligations exist. We delete the data of a user account within 30 days of the account being deleted, unless statutory retention obligations prevent this.

We store business contact data from our research database (section 5) for a maximum of 24 months from its last confirmation in the source. From the 21st month, we re-check each item against a public source, first against the company's website, then against a professional network profile. If the source confirms the information, the period starts again. If it does not confirm the information, or if the source was unreachable in at least two re-checks at least 30 days apart, we delete the record fully automatically in our weekly deletion run once the 24 months have expired, including its copies in our database (storage limitation under Art. 5(1)(e) GDPR).

Personal data held only as a copy in a company profile (such as a list of decision-makers or addresses found on the website) is deleted 24 months after its last update, also in our weekly deletion run. The period starts on 1 April 2026 at the earliest.

Exception for ongoing customer contracts: As long as a customer with an ongoing contract keeps a company in a list in its Kodo account, the continued storage of that company's contact persons is necessary to perform that contract. During this time, no deletion takes place, and the customer sees in the list and in the list export since when the information has not been confirmed. This does not apply to persons whose departure from the company is established by the re-check. When the contract ends, this exception lapses no later than 30 days after the end of the contract. After that, only the 24-month rule applies: a record whose period has already expired is deleted in the next deletion run, any other record when its own period expires and thus no later than 24 months after the end of the contract, unless the source confirms it again.

If a deleted person later reappears on a current company website through a new find, re-inclusion is permitted within the scope of our legitimate interest. Anyone who has objected is on our suppression list (section 5) and will not be included again.

9. Data Security

We protect your data with appropriate technical and organisational measures, in particular encrypted transmission (TLS), access restrictions, logging of access and regular security updates. We operate our servers and the database in the European Union (Frankfurt am Main). Some service providers also process data outside the EU; section 6 states which ones and on what basis.

10. Your Rights

Under the GDPR, you have the following rights:

• access to the data stored about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to the processing (Art. 21 GDPR)
• withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

The fastest way to exercise these rights is in the Privacy Center. You can also contact us by email at privacy@kodo-leads.com or benedict.mehlmann@kodo-leads.com.

Right to lodge a complaint: You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular with the supervisory authority responsible for us (the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg) or with the authority at your place of residence, your place of work or the place of the alleged infringement.

11. Changes to This Privacy Policy

We adapt this privacy policy when the legal situation or our service changes. You can always find the current version on this page; the date at the top shows when it was last updated.