Privacy Policy
Last updated: 1 November 2026 · Deutsche Fassung
Note: This English version is provided for convenience. In case of any discrepancy, the German version (Datenschutzerklärung) prevails.
Legal form: The incorporation of Kriyanta GmbH, with its registered office in Munich, is intended. The articles of association have not yet been notarised; accordingly, the company has not yet been entered in the commercial register. Until registration, the business is operated by Dr. Kiran Ramesh Mahajan as a sole proprietor.
Data protection officer
We are currently not required to appoint a data protection officer. If you have any questions about data protection, you can contact us at any time using the contact details above.
Visiting our website
When you access this website, our hosting provider automatically processes technical connection data in server log files, in particular IP address, date and time of access, page accessed, referrer URL where applicable, browser and device data, amount of data transferred and HTTP status code.
This processing serves the secure, stable and error-free provision of the website and the detection and prevention of attacks. The legal basis is our legitimate interest pursuant to Art. 6(1)(f) GDPR.
The website is provided via Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA. Netlify processes data as a processor on the basis of a data processing agreement. Where data is transferred to the USA or other third countries, the transfer is based in particular on appropriate safeguards such as the EU Standard Contractual Clauses and, where applicable, other transfer mechanisms.
“Request a Walkthrough” form
If you request a Kriyanta walkthrough via our form, we process the information you enter, in particular name, business email address, company, role, industry and the topic you selected.
The form is processed via Netlify Forms. The information you submit is transmitted to Netlify, processed there technically and made available to us so that we can handle your request. The legal basis is the performance of pre-contractual measures pursuant to Art. 6(1)(b) GDPR and our legitimate interest in handling business enquiries pursuant to Art. 6(1)(f) GDPR.
Requesting executive papers
If you request an executive paper from our insight series via our website, we process the information you enter, in particular first name, last name, company, business email address, role, optionally your current challenge, and the title of the requested paper.
The form is processed via Netlify Forms. We use the information to send you the requested paper and to follow up with you on this topic. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR, which you give via the checkbox in the form. You can withdraw your consent at any time with effect for the future, for example by email to Kiran.Mahajan@Kriyanta.ai. The lawfulness of processing carried out before the withdrawal remains unaffected.
Other contact
If you contact us by email or via LinkedIn, we process the data you provide, in particular name, contact details and the content of your message, in order to handle and answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry is aimed at concluding or performing a contract, and Art. 6(1)(f) GDPR for other business communication.
The privacy policy of the respective platform operator additionally applies to the processing of personal data by LinkedIn.
Fonts and embedded content
Fonts, images, audio files and documents on this website are delivered by our hosting provider Netlify. We do not embed fonts from third-party services (such as Google Fonts). External services are loaded only if you expressly consent (see Google Ads and LinkedIn Insight Tag).
Recipients and third countries
We use carefully selected service providers for hosting, form processing, email communication and technical security. Where these service providers process personal data on our behalf, they do so on the basis of a data processing agreement pursuant to Art. 28 GDPR.
Our email communication is operated via Microsoft 365 of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Microsoft may use affiliated companies and sub-processors in providing its services. Where data is processed outside the EU/EEA, the transfer is based on appropriate safeguards, in particular the EU Standard Contractual Clauses and other applicable protection mechanisms.
If you consent to the use of marketing technologies, LinkedIn Ireland Unlimited Company is also a recipient of the data collected via the LinkedIn Insight Tag. LinkedIn points out that data may also be stored on servers in the USA. For data transfers from the EU/EEA, LinkedIn refers, among other things, to the EU-U.S. Data Privacy Framework and other applicable transfer mechanisms and safeguards.
After you accept marketing cookies, Google Ireland Limited is also a recipient of data collected by the Google tag. Processing by Google companies outside the EU/EEA, including in the USA, is possible. Google provides information about processing and transfer mechanisms in the privacy notices linked above.
Storage period
Server log files are deleted or anonymised in accordance with the technical and security-related retention periods of our hosting provider. Business enquiries are deleted once they have been fully handled and no statutory retention or documentation obligations prevent deletion. If no contractual relationship arises, we regularly review whether storage is still necessary and generally delete the data after 24 months at the latest.
Information from executive paper requests is deleted as soon as you withdraw your consent or the purpose no longer applies, and at the latest after 24 months without further contact, unless statutory retention obligations prevent deletion.
Note for clients and project participants
This privacy policy covers visits to this website and contact via the channels described here. Personal data that we process for a client in the course of a transformation or implementation project is governed by the respective service agreement and, where required, a separate data processing agreement pursuant to Art. 28 GDPR.
Your rights
Within the scope of the statutory requirements, you have in particular the right of access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interests. You can withdraw any consent you have given at any time with effect for the future.
We do not make automated individual decisions within the meaning of Art. 22 GDPR regarding visitors to this website.
Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is in particular:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Germany
Email: poststelle@lda.bayern.de
Changes to this policy
We update this privacy policy when our processing practices, service providers or legal requirements change.