Legal
What this site collects, why it collects it, and who else sees it.
Last updated
01
John Baptist Kusiima decides why and how personal data is processed on kusiima.com. That makes him the controller under Article 4(7) of the EU General Data Protection Regulation (Regulation (EU) 2016/679), read together with the Bundesdatenschutzgesetz, and the data controller under Uganda's Data Protection and Privacy Act, 2019. There is one controller, not two — the same person is responsible for visitors in Germany and Uganda.
No data protection officer has been appointed. The site does not meet any of the thresholds in Article 37 GDPR or §38 BDSG that would require one — there is no large-scale monitoring here and nobody is employed to carry out the processing. Write to the address above and it reaches the person who is actually responsible.
02
This notice covers kusiima.com and the pages served from it. It does not cover the places this site links out to — a social profile, or a template's listing on the platform that sells it. Once you follow a link you are on somebody else's terms, and their notice is the one that applies.
It also does not cover email you send directly, outside the contact form. That is ordinary correspondence and it is handled the way correspondence is: read, replied to, and kept only as long as it is useful.
03
You can read every page here without giving anything, filling anything in, or agreeing to anything. There is no cookie banner because there are no cookies to consent to — the site sets none, for any purpose.
One thing still happens when a page loads, and it would be dishonest not to name it:
Typefaces are not part of it. They are downloaded at build time and served from this domain, so your browser never contacts Google Fonts and no request goes to Google when you read a page here.
04
Sending an enquiry through the contact form submits what you typed into it: your name, your email address, the subject you picked from the list, and — if you filled it in — your company, along with your message. Nothing is collected that the form does not visibly ask for.
One submission produces two emails. The enquiry itself goes to the inbox it is addressed to; a confirmation goes back to the address you gave, so you have a record that it sent. Both are delivered by Resend.
06
Templates are not sold on this site. Each one links out — to a public Notion page, or to the Notion Marketplace, Payhip or Gumroad — and following that link records nothing here. Duplicating a free template happens inside your own Notion account, and I see nothing about who did it. Anything you enter to get a paid one — your email address, payment details — goes to that platform, which handles it as its own controller under its own privacy notice. What reaches me from a sale is what the platform passes on to sellers, and it is used only for that sale.
The list on the templates page is read by this site's server from my own Notion workspace, about once an hour. That request carries nothing about you, and Notion never learns who is reading the page. The card images are fetched and served from this site too, so opening the page doesn't make your browser contact a shop.
07
Both forms on this site can put email in somebody's inbox under this domain's name — the contact form sends you a confirmation, the newsletter sends a confirmation link. That is exactly the shape of thing that gets abused, so three defences sit in front of them.
08
The site runs Vercel Web Analytics and Vercel Speed Insights. They record which pages are being read and how quickly pages load. Neither sets a cookie, and neither stores an identifier in your browser.
To tell one visit from another without one, Vercel derives a hash server-side from the request and rotates it daily, so the same reader on two consecutive days is two unrelated rows. There is no cross-site tracking, no advertising integration, and nothing that could be resolved back to you.
Legal basis: Article 6(1)(f) GDPR — a legitimate interest in knowing whether anything here is worth reading and whether it loads. Because nothing is stored on or read from your device, §25 TDDDG does not require consent for this, which is why there is no banner asking for it.
09
The site has no database and no servers of its own. Everything it does, it does through these four, each under a data processing agreement and each acting only on instructions.
Nobody is sold anything, and no data from this site is shared with anyone for advertising. The only other circumstance in which data would be handed over is a legal obligation to do so.
10
Vercel, Resend and Cloudflare are United States companies, so some processing happens outside the European Economic Area. Each is covered by the EU–US Data Privacy Framework, by Standard Contractual Clauses under Article 46(2)(c) GDPR, or by both.
For visitors in Uganda: the same processors sit outside Uganda, and section 19 of the Data Protection and Privacy Act, 2019 permits that where the receiving country provides adequate protection or where you have consented. The safeguards above are what is relied on.
A copy of the relevant safeguards can be requested by email.
11
Under the GDPR, and in substantially the same terms under Uganda's Data Protection and Privacy Act, 2019, you can ask for any of the following:
Email hello@kusiima.com to exercise any of these. There is no form to fill in and no charge. An answer comes within a month, and if it needs longer than that you will be told why before the month is up.
You can also complain to a regulator, and you do not have to raise it here first. In Germany that is the data protection authority for the state where you live, work, or where you think something went wrong — see bfdi.bund.de for the list. Elsewhere in the EEA it is your national supervisory authority. In Uganda it is the Personal Data Protection Office at pdpo.go.ug.
12
13
The site is served over HTTPS everywhere, sends security headers on every response, and holds no credentials in anything the browser downloads. Form input is length-limited and validated on the server, not only in the browser. Newsletter links are signed so they cannot be forged or re-pointed at another address.
None of that is a guarantee. No system is beyond reach, and anyone who tells you otherwise is selling something. If you find a problem here, email the address above and it will be taken seriously.
14
This site is aimed at people and businesses looking for help with Notion, not at children, and it does not knowingly collect anything from anyone under 16. If you believe a child has sent something through a form here, email the address above and it will be deleted.
15
This notice changes when the site does — a new processor, a new form, a new reason to hold something. The date at the top of the page is the date of the last change of substance.
There is no mailing list for notice changes and you will not be emailed about them, with one exception: if a change ever meant using data you already gave for a genuinely new purpose, that would need asking you first, and you would be asked.