Privacy Policy

Note: This policy applies to the public website kitale.de. Privacy information for the use of the KITALE app is shown to parents during registration inside the app.

When you access our website, technical data is automatically transmitted to our server and temporarily stored in server log files:

• IP address of the requesting device (stored shortened/anonymised)
• date and time of access
• URL requested / referrer URL
• browser, language and operating system used
• HTTP status code and data volume transmitted

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stable and secure operation of the website). Log files are deleted after 30 days at the latest, unless needed to investigate a security incident.

The website is hosted by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) in a data centre in Germany. Hetzner processes the log data on our behalf as a processor pursuant to Art. 28 GDPR.

If you contact us by e-mail (e.g. hello@kitale.de) or via a form on our website, we process the data you provide (name, e-mail, content of your message) in order to respond to your enquiry. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and/or (f) (legitimate interest in answering your enquiry). Data is deleted once the purpose of processing has ceased, at the latest after 6 months, unless there are statutory retention obligations to the contrary.

If you sign up for our waitlist, we process your e-mail address and, where applicable, your name/organisation in order to inform you about the launch and important product updates. Legal basis: your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future, e.g. by e-mail to privacy@kitale.de.

This website uses only technically necessary cookies (e.g. for language settings). These do not require consent under § 25(2) TDDDG.

For anonymous reach measurement we use Plausible Analytics (Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia). Plausible is cookieless and does not process personal data – only aggregated, anonymised statistics are generated. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reach analysis). Processing by Plausible can be declined via the cookie banner (sets plausible_ignore=true).

We also operate a self-hosted analytics beacon that creates an anonymised access log on our server in Germany with each page visit. The following data is collected: page visited, timestamp, browser category (e.g. Chrome, Safari), referrer domain and a daily-rotating pseudonymous visitor hash (64-bit HMAC under a daily-rotated key – after day end, linking the hash back to a person is mathematically infeasible). No raw IP addresses are stored, no cookies are set and no fingerprinting is used. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in website reach analysis). Data is automatically deleted after 12 months. Processing can be declined via the cookie banner.

Your data is only transferred to third parties listed as processors (hosting, reach analytics) or where we are legally required to do so. A transfer to third countries outside the EU/EEA only takes place within the feature described in section 11 (customer voices) and exclusively on the basis of your explicit consent.

Under the GDPR you have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent (Art. 7(3) GDPR)

To exercise your rights, please contact privacy@kitale.de.

We take appropriate technical and organisational measures pursuant to Art. 32 GDPR to protect your data from unauthorised access, loss or manipulation. Transmission is carried out exclusively via encrypted TLS connections (HTTPS).

If you submit a customer voice via our form “Tell us your story” (kitale.de/en/stimme-abgeben), we process your answers to the three questions, your name, role and institution, and your e-mail address. From your answers we create a draft text with AI support, which you edit and finally approve yourself. Only the text you approve is published on kitale.de after an internal review, with the visibility you chose (full name, first name only or anonymous).

Legal basis: your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future, e.g. by e-mail to privacy@kitale.de. We will then remove the publication promptly.

To create the draft, we transmit your answers to Google (Gemini API, Google Ireland Ltd. / Google LLC, USA). To send the confirmation e-mail we use Brevo (Sendinblue SAS, France/EU) as a processor.

We store the proof of your consent (e-mail address, timestamp, approved text) separately from the published quote, for as long as the quote is published and beyond that to document the consent. Your e-mail address is not published.