Privacy Policy

Note: This policy applies to the public website kitale.de. Privacy information for the use of the KITALE app is shown to parents during registration inside the app.

When you access our website, technical data is automatically transmitted to our server and temporarily stored in server log files:

• IP address of the requesting device (stored shortened/anonymised)
• date and time of access
• URL requested / referrer URL
• browser, language and operating system used
• HTTP status code and data volume transmitted

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stable and secure operation of the website). Log files are deleted after 30 days at the latest, unless needed to investigate a security incident.

The website is hosted by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) in a data centre in Germany. Hetzner processes the log data on our behalf as a processor pursuant to Art. 28 GDPR.

If you contact us by e-mail (e.g. hello@kitale.de) or via a form on our website, we process the data you provide (name, e-mail, content of your message) in order to respond to your enquiry. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and/or (f) (legitimate interest in answering your enquiry). Data is deleted once the purpose of processing has ceased, at the latest after 6 months, unless there are statutory retention obligations to the contrary.

If you sign up for our waitlist, we process your e-mail address and, where applicable, your name/organisation in order to inform you about the launch and important product updates. Legal basis: your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future, e.g. by e-mail to privacy@kitale.de.

This website uses only technically necessary cookies (e.g. for language settings). These do not require consent under § 25(2) TDDDG.

On the password-protected pages for individual institutions (section 13), your browser stores the name you enter for feedback, on the pages for schools also the school or after-school care centre and your own answers, and the passages you commented on in its local storage (localStorage), so that you do not have to enter this information again and can see what you have already answered or commented on. This information does not leave your device. Storing it is strictly necessary for the function you requested (§ 25(2) no. 2 TDDDG). You can delete it at any time in your browser settings.

For reach measurement we operate a self-hosted analytics beacon that creates an anonymised access log on our server in Germany with each page visit. The following data is collected: page visited, timestamp, browser category (e.g. Chrome, Safari), referrer domain and a daily-rotating pseudonymous visitor hash (64-bit HMAC under a daily-rotated key – after day end, linking the hash back to a person is mathematically infeasible). No raw IP addresses are stored, no cookies are set and no fingerprinting is used. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in website reach analysis). Data is automatically deleted after 12 months. Processing can be declined via the cookie banner.

Your data is only transferred to the processors named in this policy (hosting, e-mail delivery, code management) or where we are legally required to do so. A transfer to third countries outside the EU/EEA only takes place within the feature described in section 11 (customer voices) on the basis of your explicit consent, and for feedback under section 13 to GitHub (USA) on the basis of the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR).

Under the GDPR you have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent (Art. 7(3) GDPR)

To exercise your rights, please contact privacy@kitale.de.

We take appropriate technical and organisational measures pursuant to Art. 32 GDPR to protect your data from unauthorised access, loss or manipulation. Transmission is carried out exclusively via encrypted TLS connections (HTTPS).

If you submit a customer voice via our form “Tell us your story” (kitale.de/en/stimme-abgeben), we process your answers to the three questions, your name, role and institution, and your e-mail address. From your answers we create a draft text with AI support, which you edit and finally approve yourself. Only the text you approve is published on kitale.de after an internal review, with the visibility you chose (full name, first name only or anonymous).

Legal basis: your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future, e.g. by e-mail to privacy@kitale.de. We will then remove the publication promptly.

To create the draft, we transmit your answers to Google (Gemini API, Google Ireland Ltd. / Google LLC, USA). To send the confirmation e-mail we use Brevo (Sendinblue SAS, France/EU) as a processor.

We store the proof of your consent (e-mail address, timestamp, approved text) separately from the published quote, for as long as the quote is published and beyond that to document the consent. Your e-mail address is not published.

Institutions, providers and contract partners can sign contracts and agreements that we make available to them on a password-protected page under kitale.de/einrichtung/ electronically. To do so, you enter your name, role and e-mail address. You receive a confirmation link by e-mail that is valid for ten minutes and exactly once. After signing, we process:

• name, role and e-mail address
• the image of your signature and the signed document
• time of the request and of the signature
• the IP address at request and at signature, and the browser identifier (user agent)
• checksums of the document before and after signing

The purpose is concluding and documenting the contract. Legal basis: Art. 6(1)(b) GDPR (conclusion of a contract) and Art. 6(1)(c) and (f) GDPR (statutory retention obligations, legitimate interest in proving who signed when and in which role). You and we receive the signed document by e-mail.

The data is stored on our server at Hetzner in Germany (section 3). To send the e-mails we use Brevo (Sendinblue SAS, France/EU) as a processor. We store the data for the term of the contract and beyond that for as long as statutory retention obligations apply (generally six to ten years under Section 257 HGB and Section 147 AO). Unused confirmation links expire after ten minutes.

On password-protected explanation pages for individual institutions (kitale.de/einrichtung/…) you can highlight text and give feedback on it, or write general feedback. We process your name, the highlighted passage, the section, your comment, the page and the time. We do not store your IP address; it is only used briefly in memory to limit mass submissions.

On the pages for schools, after-school care and all-day programmes (kitale.de/einrichtung/schule/…) you can also answer questions. We process your name, your school or after-school care centre, the question, the answers you selected, your text, the page and the time. If you change or withdraw an answer, we store this as a new entry; the latest one is evaluated.

Instead of answering online, you can send us the fillable answer sheet (PDF) by e-mail to hello@kitale.de (section 4). We then also process the information in the sheet (name, school or after-school care centre, role, date, answers) and your e-mail address. We transfer the answers like online answers and delete the e-mail with the sheet once they have been transferred.

The purpose is to coordinate the page with the institution, the provider and the specialist advisor involved. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in assigning and incorporating feedback on a proposal) or Art. 6(1)(b) GDPR where the coordination serves to prepare a contract. For the pages for schools, the purpose is to identify the needs of schools, after-school care and all-day programmes in order to develop KITALE further for them. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in developing our offer based on feedback from future users).

Feedback is first stored on our server at Hetzner in Germany (section 3) and then transferred to our non-public code repository at GitHub (GitHub B.V., Netherlands, or GitHub Inc., USA), where we incorporate it. Only Marc Baumgartner and Felix Degeler can edit it. During the coordination, everyone who has received the password for the page can also see it, with name and comment. Answers and feedback on the pages for schools can only be seen by Marc Baumgartner and Felix Degeler, not by other schools, even if they have received the same password. Before a page goes to a new group, we hide it. After collection we delete it from the server. In the code repository we delete it once the coordination of the page is complete, at the latest twelve months after receipt. Earlier versions of the code repository (version history) still contain it; only Marc Baumgartner and Felix Degeler have access to those as well.