1. Data controller
TK-SHK, owned by Tom Stefan Karg
Barnetstraße 31a, 12305 Berlin
Phone: +49 30 86323140
Email: service@tk-shk.com
2. Website hosting
This website is hosted by Hostinger. When you visit, technically necessary connection data is processed, including your IP address, the time of access, the requested page, and browser and operating system information. This supports delivery, stability and security of the website. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure operation of our website.
Information about Hostinger is available in the provider’s privacy notice.
3. Contact and customer enquiries
For enquiries by phone, email or form, we process the information you provide to handle your request. The form requires customer type, name, town or city, postcode, phone number, email and a description. Project selection, scope, building type, equipment, error code, preferred timing, budget, photos and documents remain optional. The legal basis for contractual or pre-contractual enquiries is Article 6(1)(b) GDPR; otherwise it is Article 6(1)(f) GDPR (responding to your enquiry).
You may optionally upload up to 20 project photos and 20 documents (PDF, DOCX, XLSX, PPTX, ODT, ODS, ODP, RTF, CSV, TXT, XML, GAEB-XML). These are sent exclusively to TK SHK and stored outside the public website directory. Photos are re-encoded as JPEG files, removing embedded metadata such as GPS coordinates. Documents are stored unchanged and may contain their own metadata. Only authorised administrators can access internal copies. Attachments are deleted with their associated enquiry after 90 days during the next cleanup run. Please upload only documents needed for your project.
Form enquiries are stored internally in WordPress and a notification email is sent to TK SHK. Internal website copies are deleted after 90 days during the next scheduled cleanup. Emails and any resulting business relationship are subject to purpose-based retention and legal requirements. Form contents are not automatically sent to the AI service. A chat alone does not confirm an order or appointment.
Funding and cost checks
The answers in our grant and cost checks are processed in the memory of your browser tab. These answers are not sent to OpenAI or Google Analytics. Income and family details are not stored or copied into a customer enquiry. Check entries are discarded when you leave or reload the page. Only when you explicitly submit an enquiry do you send the visible project details and optional photos to TK SHK; the contact enquiry rules described above apply. Manually entered postcodes are matched locally using a stored directory.
Optional use of your current location
The “Use current location” button only requests location permission from your browser after you click it. Your coordinates and IP address are sent to Photon / komoot (photon.komoot.io, address data from OpenStreetMap) to find a suggested address. Inaccurate positions are not sent for address lookup. The federal state is determined on your device. The website does not store coordinates or send them to Luna or Google Analytics. The suggestion is copied into the form only after your confirmation; the visible address is sent to TK SHK only when you submit your enquiry. Please check the house number, postcode and project location. Manual entry is always available without granting location permission.
3a. Job applications
If you apply for a job at TK-SHK, we process your contact details, qualifications and professional experience, application documents and our correspondence to assess your application, communicate with you and decide whether to establish an employment relationship. The legal basis is section 26(1), first sentence, of the German Federal Data Protection Act (BDSG), together with Article 88 GDPR; where necessary, Article 6(1)(b) GDPR also applies to pre-contractual steps taken at your request.
The owner and the people responsible for the selection procedure receive access insofar as necessary for their duties. Service providers used for email, storage and IT operations may process the data on our behalf. Documents necessary in connection with legal claims may also be shared with legal advisers, courts or competent authorities.
Providing your application data is voluntary. However, without the information required for the advertised role, we cannot assess your suitability. Please submit only documents necessary for your application.
The retention period depends on the progress and completion of the selection procedure. After it ends or an application is withdrawn, the data is deleted once no longer needed for the decision or for establishing, exercising or defending legal claims. Any necessary further retention is governed in particular by statutory time limits for claims arising from the application procedure and, in a specific dispute, its final resolution. Processing to safeguard legal claims is based on Article 6(1)(f) GDPR; our legitimate interest is to protect our legal position. Statutory retention duties remain unaffected. If an employment relationship is established, the data required for it will continue to be processed to carry it out.
For questions and to exercise your data protection rights, please contact service@tk-shk.com. The information about the controller and your rights in this privacy notice also applies to job applications.
4. TK SHK assistant
Once you expressly agree at the start, the optional AI chat processes your messages automatically through the OpenAI API. The recipient is OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. Processing is used to answer relevant questions and prepare an enquiry. The legal basis is your consent under Article 6(1)(a) GDPR. You can stop further processing at any time by selecting “End chat & clear messages”; this does not affect the lawfulness of earlier processing.
Your messages and the limited conversation history are sent to OpenAI through our server. Please do not include sensitive information in the chat; enter contact details only in the separate enquiry form. We do not store chat history in our WordPress database. After you explicitly start the chat, the conversation and message draft are temporarily saved in this browser tab’s session storage so you can continue after navigating to another page or accidentally reloading. After 30 minutes without chat activity, the conversation is no longer restored. “End & delete chat” removes it immediately. Enquiry forms and photos are not saved this way. Chat-window and Luna-icon positions are also remembered only for the browser session.
The API is called with store: false is called. By default, OpenAI does not use API content to train models unless different data-sharing settings have been enabled. OpenAI may nevertheless retain security/abuse-monitoring logs for up to 30 days, or longer under legal or security exceptions. Further information: OpenAI privacy policy and API data processing.
Processing by OpenAI outside the EEA
When the OpenAI API is used, your chat messages and the conversation context provided may be processed outside the European Economic Area, particularly in the USA. Under clause 4.1 of the OpenAI Data Processing Addendum OpenAI Ireland Limited safeguards such onward transfers to affiliates or subprocessors through the European Commission’s Standard Contractual Clauses under Article 46(2)(c) GDPR or, where applicable to the recipient, an adequacy decision under Article 45 GDPR. The terms and the list of subprocessors are publicly available. Information about the safeguards applicable to your data and a copy of the relevant contractual safeguards can be requested via service@tk-shk.com .
The assistant does not replace an on-site inspection, a professional diagnosis or an emergency call. Answers may be incorrect. To prevent abuse, we use short-lived session tokens and server-side counters based on a daily keyed hash of the IP address. Raw IP addresses are not stored in these counters; technically necessary hosting logs are separate. Counters expire within one day and are deleted during the following cleanup. The legal basis is Article 6(1)(f) GDPR (security and cost control).
Security check
To help prevent automated misuse, we host ALTCHA on our own server. The security check performs a short computation in your browser; no picture puzzles are required. No data is sent to an external CAPTCHA provider and no CAPTCHA tracking cookies are set. Challenges expire after ten minutes and can only be used once. A verified session lasts up to one hour. Telephone and email remain available without this check.
5. Website analytics
With your consent, we use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We analyse page views, visitors, landing pages, traffic sources and selected contact interactions. The Google tag loads only after you agree to “Analytics”. If you decline, this integration sends no data to Google. The legal bases are Article 6(1)(a) GDPR and Section 25(1) of the German TDDDG.
Analytics uses pseudonymous identifiers and technical information. It records pages from a predefined list and events such as phone or email clicks, confirmed enquiries and use of the assistant. For project enquiries, only the selected predefined service category (such as gas boiler replacement) is sent as service_type are transmitted. Names, telephone numbers, email addresses, postal addresses, form contents and chat messages are not transmitted as event parameters. URLs are sent without query parameters or fragments, and referrer information is limited to the origin. Google receives connection information for technical reasons. Google Signals, advertising personalisation and the transmission of user-provided data are not intended for this integration.
Data transfers by Google Analytics
Google Analytics data may also be processed by Google LLC in the USA. According to Google’s published information, Google LLC is certified under the EU–US Data Privacy Framework. For transfers covered by this certification, Google relies on the corresponding European Commission adequacy decision under Article 45 GDPR. For further transfers to third countries not covered by an applicable adequacy decision, Google’s data protection terms provide for Standard Contractual Clauses under Article 46(2)(c) GDPR.
Details are available in Google’s information on international data transfers, the data processing terms and the associated Standard Contractual Clauses. Information on certification and further safeguards is also available in Google’s data transfer frameworks . Your consent to analytics remains independently required and can be withdrawn at any time through “Cookie settings”.
The analytics cookies _ga and _ga_… are limited to a maximum of 180 days. The property is configured to retain personal event data for 2 months. You can withdraw consent at any time via “Cookie settings” in the footer. This reloads the page and deletes these analytics cookies. Further information: Google privacy policy.
The selected language is saved as a functional setting locally in your browser. You can change it anytime in the language menu. The first access without a stored selection is in German.
6. Your privacy settings
Your choice is stored as an essential setting under tkshk_privacy_choice in your browser’s local storage. We store the configuration version, choice and time, but no contact details. The choice is valid for up to 180 days; expired entries are discarded on your next visit. You can change it at any time via “Cookie settings” or delete it in your browser. If storage is disabled, the website will ask again on a later visit. The legal basis for storing your requested choice is Section 25(2)(2) TDDDG; processing supports reliable privacy management under Article 6(1)(f) GDPR.
No marketing or advertising services are used. Consent to the optional AI chat is obtained separately when you start the chat and is independent of your analytics choice. The website, contact options and enquiry form work without analytics consent.
7. Local media and external links
Images, typography and animations are provided locally. Maps are not embedded automatically. If you open external links, the respective provider’s privacy policy applies.
8. Your rights
Subject to the applicable legal conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. Where processing is based on consent, you may withdraw it with effect for the future.
You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation.
You also have the right to lodge a complaint with a data protection supervisory authority, such as the Berlin Commissioner for Data Protection and Freedom of Information.
For questions about your data, please contact service@tk-shk.com.
Updated: 14 October 2026
