Privacy policy
This page explains what personal data Kita Berlin collects, why we collect it, how long we keep it, who can access it, and how you can exercise your rights under the EU General Data Protection Regulation (GDPR) and the German Bundesdatenschutzgesetz (BDSG).
1. Data controller
The data controller responsible for processing your personal data on this site is the operator of kita-berlin.makerilabs.com, identified in the Impressum. You can reach us at kita-berlin@makerilabs.com.
2. What data we collect, when, and why
2a. Waitlist signup (landing page email form)
When you submit the email-capture form on the landing page, we store:
- Your email address (provided by you)
- Your selected interface language (e.g.
en,de) - Which A/B test variant you landed in (anonymous bucket label "A" or "B")
- The UTM source query parameter if present (e.g. which outreach channel sent you)
- Your IP address — cryptographically hashed (SHA-256) before storage, so we can detect duplicate signups without retaining your raw IP
- Your country and city as derived by Cloudflare's edge headers (e.g. "DE", "Berlin")
- The timestamp of submission
- Your browser's user-agent string and HTTP referer
Lawful basis: Article 6(1)(b) GDPR — performance of a contract (the contract being your waitlist signup so we can notify you when the service launches).
2b. Kitagutschein form-fill (Gutschein page)
When you submit the Kitagutschein form, the data you enter (parent and child information, address, employment status, requested care details) is used in-memory only to fill the official 91-field Berlin Senate Kitagutschein PDF, which is then returned to you as a download. The full form data is NOT stored on our servers after the PDF is generated.
For analytics and to add you to the waitlist, we DO store a summary record:
- Your email address
- Your selected interface language
- Your child's birth year (year only, not full date of birth)
- Requested Kita start date
- Requested hours per day
- Whether a second parent was included (boolean)
- Employment status categories (e.g. "full-time", "parental-leave")
- SHA-256 hashed IP address, country, city
- Timestamp of submission
Lawful basis: Article 6(1)(b) GDPR — performance of a contract (delivering the filled PDF you requested), plus Article 6(1)(f) — legitimate interest in product improvement.
2c. Cookies
We set the following first-party functional cookies. None are used for tracking, advertising, or profiling. No consent banner is required under TTDSG §25(2) for these strictly-necessary cookies:
kb_locale— remembers your chosen interface language. 1-year lifetime.kb_vid— a randomly-generated visitor identifier so we can show you the same A/B test variant on every visit (consistency). 1-year lifetime.
We do not use any third-party analytics, advertising, marketing, or social-tracking cookies.
3. How long we keep it
Submission records (both the waitlist and the Gutschein summary) are stored with a 2-year automatic expiration in Cloudflare KV. After 2 years they are deleted automatically by Cloudflare's expiration mechanism. This covers a full Berlin Kita-application cycle plus a buffer for dispute resolution.
The full Kitagutschein form data (parent + child details) is held in-memory only during the PDF-generation request (typically <5 seconds) and is never persisted to disk on our servers.
4. Who has access
Your data is stored on Cloudflare's KV storage product. Cloudflare acts as our data processor under Article 28 GDPR, governed by Cloudflare's standard Data Processing Addendum.
Within our team, the data is accessible only to the operators listed in the Impressum. We do NOT share, sell, rent, or transfer your data to any third party for marketing or any other purpose. We do NOT transfer your data outside the EU.
5. Your rights
Under GDPR, you have the right to:
- Access — request a copy of the personal data we hold about you (Art. 15)
- Rectification — correct inaccurate data (Art. 16)
- Erasure ("right to be forgotten") — request deletion of your data (Art. 17)
- Restriction — limit how we process your data (Art. 18)
- Data portability — receive your data in a machine-readable format (Art. 20)
- Object to processing based on legitimate interest (Art. 21)
- Withdraw consent at any time, where processing is based on consent (Art. 7)
- Lodge a complaint with a supervisory authority (Art. 77). The competent authority for Berlin is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.
To exercise any of these rights, email kita-berlin@makerilabs.com. We will respond within 30 days.
6. Security
Your data is transmitted over HTTPS with valid TLS certificates (Google Trust Services). Cloudflare encrypts data at rest in their KV storage. We apply standard web security headers (Content-Security-Policy, HSTS, X-Frame-Options) to reduce attack surface. We rate-limit our API endpoints to prevent abuse.
7. Changes to this policy
We may update this policy as the product evolves (for example, when we add payment processing or transactional email). Material changes will be announced via a notice on the landing page for at least 30 days.
Last updated: 2026-05-24.