Privacy Policy

Web app app.bienenstock-kita.de

At a glance

Hosting & data location

App databases, hosting and error monitoring: Germany. Cloudflare KV (Parent App): EU. Technical e-mail (Brevo): hosting France/Germany (OVH), storage Belgium (Google Cloud). E-mail mailbox: Netherlands. Core data exclusively in the EU. Exceptions with a non-EU connection: Apple/Android push, wallet cards, the optional AI image generation (global endpoint, see 2.7) and the public websites of the facilities (Cloudflare Pages, worldwide delivery).

Encryption

TLS 1.2/1.3 for every transmission. HTTPS only. No unencrypted interfaces.

Separation & pseudonymity

Separation of data by facility at database level via row-level security (kita_id check) on every table. Parent App without external user accounts - access only via pseudonymised child codes. Optional pseudonymised operation of the entire Software possible (identifiers instead of real names).

Non-EU transfer

Functions with non-EU transfer: Apple and Android push notifications (Parent App and Staff App), wallet cards, the optional AI image generation (global endpoint, no EU residency commitment; see 2.7 and Annex C of the AVV) and the public websites of the facilities (Cloudflare Pages, worldwide delivery).

1. Controller and Processor

The controller within the meaning of the GDPR (Art. 4 no. 7) for the processing of personal data is the respective Träger (operator) of the Kita (day-care centre) or the facility that uses the Software.

The processor pursuant to Art. 28 GDPR is:

997 Ventures UG (haftungsbeschränkt)
Sonnenhof 13
67677 Enkenbach-Alsenborn
E-mail: info@bienenstock-kita.de

997 Ventures UG processes personal data solely on behalf of and on the instructions of the controller. The relationship between controller and processor is governed by the Data Processing Agreement (AVV).

2. Collection and Processing of Personal Data

2.1 Automatically recorded data (server logs)

With every access to the web app, the following information is recorded automatically:

• IP address
• Date and time of access
• Name and URL of the file(s) retrieved
• Website from which access takes place (referrer URL)
• Browser used, operating system and access provider

To protect against password guessing, after failed attempts we store for around one hour a non-reversible check value of the network and of the incorrectly entered value, not the IP address or the value itself.

Purpose: Establishing the connection, security, system stability, detection of misuse.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest).

2.2 Registration data

• Name, e-mail address, password (stored encrypted)
• Account information, where applicable telephone number and organisation

Purpose: Performance of the contract, authentication, account management.
Legal basis: Art. 6(1)(b) GDPR (performance of the contract).

2.2a Träger accounts: viewing, invitation and editing

A Träger account can view the data of the facilities (Kitas) assigned to the Träger. Holders of a Träger account can invite further users by e-mail to join the Träger account. After the invitation is accepted, these users receive the same access: they can view and edit the data of the assigned Kitas. There is no access to the data of other Träger. The invitation and the assignment of access are the responsibility of the Träger as controller.

Purpose: Träger management and cooperation across several facilities.
Legal basis: Art. 6(1)(b) GDPR (performance of the contract).

2.3 Usage data (Kita operation)

The division into mandatory and optional data is set out in AVV §3. The real name of the child is not mandatory; if it is left empty, "No name" is displayed. The age category follows from the date of birth. For each staff member, the following are mandatory: name or identifier, ID/pseudonym, check-in/check-out timestamps and - where configured - the staff type. Statistical data and Art. 9 data as well as facility and configuration data (e.g. thresholds, opening hours, meal cancellation deadlines, Träger requirements) are optional.

• Master data: names, date of birth, type/mode of care, group memberships; optional at the request of the Träger: care period (start/end of contract)
• Attendance times (drop-off and pick-up times via the check-in/check-out terminal)
• Discarded check-in actions: deliberately retained after deletion of the person concerned (documented retention, see 8.)
• Working and attendance times of staff (terminal as well as home-office check-in and time reports via the Staff App), including a work-location marker for each timestamp (home office, excursion, off-site)
• Staff time evaluations for management and Träger (per facility and across all facilities of the Träger, including export); staff members can view their own times
• Further child master data: gender, contractual care time, participation in lunch, school attendance, weekend care, admission, departure and archiving dates; optional e-mail addresses and telephone numbers of the legal guardians on the child record (for document and meal billing receipts of the Träger, as well as for the QR letter, consent requests and confirmations of parent meeting appointments of the facility), and optional billing characteristics for meal billing
• Optional: free-text notes on the child, also visible to staff in the group view - the scope of personal data follows from the respective entry
• Optional: photo of the child for recognition by staff, only with the release "Photo of the child on the Kita's devices" granted by the parents; it is not processed with AI and is deleted upon withdrawal of the release
• Staff master data and planning: staff type/type of employment, personnel number, contract data (date of employment, fixed term, end of contract, third-party employment, practical instruction, work areas), daily/weekly/monthly working hours, planned shifts, absences, shift templates, time account, session data of the Staff App (stored hashed)
• Statistical data (optional, only to the extent required for official statistics): including gender, month/year of birth, school year/age group, scope of care, place of residence (child) as well as scope of employment, vocational training qualification, professional status, type of employment, work area and collective-agreement pay grade (staff)
• Special categories (Art. 9 GDPR): allergies/intolerances (health) and an optional free-text meal note (in practice allergy and dietary information; the scope follows from the respective entry) - where supplier access is enabled, passed on to the meal supplier named by the Träger; information on disability or integration assistance as well as on origin and primary family language - optional, only to the extent required for official statistics. The processing takes place solely on behalf of the controller; the legal basis under Art. 9(2) GDPR is ensured by the responsible Träger
• E-mail addresses of the legal guardians and dispatch log (which document was sent when to which address)
• Application-specific error logs, insofar as a person ID is contained in the context (in addition to error monitoring via Sentry, see 2.8)
• Poll votes with device ID (one vote per device, to prevent multiple voting)
• Interactions within the app, timestamps
• Group reports, daily reports and notices as free text; storage on German servers. Parents see daily reports and notes on the child in the Parent App only if the staff expressly release them with "Share with parents" and the facility has enabled the display in the Parent App (default: off)
• Releases per child with the grant (time, origin facility or parents, wording) and withdrawal; consents of the legal guardians by confirmed e-mail. Upon confirmation, neither the name nor the IP address nor the device is stored; the confirmation is evidenced via the stored address, not the person
• Authorised pick-up persons (name, relationship, origin; for a notification by the parents, the power-of-attorney text and the time of confirmation; time of the ID check without ID data), reported pick-ups and handover records (person handed over, reason for exception, confirming educator, time)
• Appointments with acceptances and declines per child; parent meeting requests and staff appointments; room bookings
• Optional: parent payments and membership fees (payment items, payment reference code, cash payments with name or identifier of the accepting person, invoice recipient) and, with a bank connection, amount, booking date and purpose of transactions that are or are to be assigned to a parent payment (name and IBAN of the payer are processed only when retrieved, not stored; see 5.)
• Optional: recording of a parent meeting with prior consent (name, role, signature or confirmed e-mail); the recording is deleted after evaluation
• Optional (Träger): applications for a childcare place via the application portal

Purpose: Organisation of Kita operations, fulfilment of statutory documentation obligations (under the national law of the controller's Member State), capacity documentation, official statistics, communication with legal guardians including document and meal billing receipts, catering management.
Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(c) GDPR (legal obligation); for special categories of personal data Art. 9(2) GDPR (in particular point (g) in conjunction with the national law of the controller's Member State, or point (a)).

2.4 Communication data

• Messages between the facility and legal guardians, also to an individual family (in the Parent App and, at the facility's request, by e-mail in the name of the facility); replies from legal guardians only as predefined actions ("OK", "Accept", "Appointment", "Join") with timestamp, no free text. Legal guardians continue to grant releases only via confirmed e-mail
• Meal cancellations and other notices via the Parent App
• Sending of documents to legal guardians by e-mail (address stored on the child record), including the dispatch log (which document was sent when to which address)
• Internal staff chat (content, timestamp, sender name or identifier); not intended for sensitive content; automatic deletion after the retention period chosen by the facility (1 to 7 days, default 1 day) at midnight in the time zone of the facility; pinboard messages are permanently excluded from this deletion. For each rule, the facility can set whether the system writes automatic working-time notices into the chat (mandatory break default off; "planned, but not present" and "daily working time reached" default on; "Not checked out" always on). These notices name the person concerned and are visible to the team in the chat. Working-time corrections from the Staff App go as a change request to management, not into the team chat
• E-mails to legal guardians in the name of the facility: QR letter (with or without parent password, depending on the setting of the facility), consent requests, confirmation of an agreed meeting appointment. The e-mails are sent in the name of the facility ("[name of facility] via Bienenstock") to the one address that the facility has stored for the child. The Software does not track whether they are delivered. Release and recording consent requests are recorded in the dispatch log together with the recipient address
• Messages between the facility and the Träger, including e-mail copies to the facility's distribution list and forwardings by the Träger
• Contact requests and support messages
• Uploaded files (e.g. documentation)

Free-text fields: Users can enter free text in many places: notes, messages, reasons, chat. The content results solely from the entry and may in individual cases also contain health data or data of third parties. In fields that the AI assistant can read, the interface asks users not to enter health data; the text is transmitted and stored as it was written. The facility instructs its users on what belongs in free text. We do not analyse free text for our own purposes. Who can read it and when it is deleted depends on the function (Annex 4 of the AVV). Free texts addressed to parents or published on the facility's website appear only once the facility expressly releases or publishes them.

Purpose: Parent communication, administration, support.
Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(a) GDPR (consent, for voluntary use of the app).

2.5 Device and session data

• Browser type, operating system, device identifier
• Device ID for poll votes (solely to ensure one vote per device)
• Session IDs
• Pseudonymous push tokens (when notifications are enabled), linked in the Parent App with groups and with the child identifiers stored on the device

Purpose: Security, delivery of push notifications, session management.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest) and Art. 6(1)(a) GDPR (consent, for push notifications).

2.6 Support via WhatsApp

We optionally offer support via WhatsApp. WhatsApp is a service of Meta Platforms Inc., based in the USA. If you use this channel, the following applies:

• Do not share personal data: Do not send personal or sensitive data via WhatsApp (e.g. names of children, dates of birth, health data, photos or documents with personal content). The channel serves exclusively for general enquiries and technical support.
• Data storage outside the EU: WhatsApp messages are processed and stored on servers of Meta Platforms Inc., which may also be located outside the European Union (in particular in the USA). By using WhatsApp to contact us, you agree that the content of your messages may be stored outside the EU.

Purpose: Optional support channel for general and technical enquiries.
Legal basis: Art. 6(1)(a) GDPR (consent through active use of the channel). For data-protection-compliant communication involving personal data, please use e-mail to info@bienenstock-kita.de or the communication functions within the Bienenstock platform.

2.7 AI functions (Vertex AI / Gemini)

We offer AI-supported functions in the administration interface, in the Träger area, on the group tablet (voice dictation) and, only if your facility switches them on, in the Staff App. The check-in terminals have no AI functions; the Parent App only has AI translation, and only at the "All" level. The functions can be switched on and off individually.

What the AI learns about persons is determined by your facility with the AI data protection level: "Off", "Pseudonymised" (children and educators only as identifiers such as "Child 7F3A") or "All" (real names of educators and children; default setting; a later change to "All" is confirmed separately). The Träger can set a maximum level; the lower level applies. The level applies to the functions that read operational data (Autopilot, shift plan AI, daily analysis, AI assistant of the Staff App, Träger Autopilot, monthly report). What your team itself writes (team chat, pinboards, notes, appointments) is read by the AI at every level except "Off" as it was written, including names contained therein. Reasons for absence are never passed to the AI in relation to a person.

Functions that process only what you enter, speak or upload (dictation, e-mail helper, parent meeting, AI text drafts, website builder, floor plan, hazard AI, handbook draft, help and AVV chat) do not depend on the level: data is passed to the AI there only if you call the function yourself in the individual case; if you do not use it, nothing is transmitted. The website builder, voice dictation (and with it the e-mail helper, parent meeting and AI text drafts) and the floor plan can additionally be switched off. The image generation and the AI assistant of the Staff App run only after being switched on. AI functions are uniformly marked in the Software (violet buttons with a sparkle symbol).

Protection for inputs: You or your facility are responsible for what you enter in AI functions. In addition, the AI rejects inputs containing health data, other especially protected data, access credentials or, depending on the level of your facility, names, and aborts. Such inputs are not stored; until then, they were processed only on the EU endpoint, without training.

The sub-processor is Google Ireland Ltd. / Google Cloud (Vertex AI / Gemini Enterprise Agent Platform), secured by the Vertex AI Data Processing Addendum. Inputs are not used to train AI models. Google generally does not store inputs permanently; only in the case of a suspicion of misuse detected by automatic filters, for up to 90 days for abuse review in the EU. All processing of text, speech and image content runs via the EU multi-region endpoint (aiplatform.eu.rep.googleapis.com). The exception is the generation of images (website images, terminal logo, preview images of hazard topics) on the global endpoint; only image descriptions without personal reference go there, and for the image generator with a non-EU model also your free text and your reference images.

The data flows in brief:

• Autopilot chat and "Own export" (management, after admin password): questions, key figures, logs per person according to the level, group names, free text of the team. Proposed actions are executed only after confirmation by management.
• Shift plan AI: shift plan, persons with contract times, demand; runs only at the "All" level; changes the shift plan directly, each change is marked and can be reversed.
• Daily analysis (automatically before closing time on days with high utilisation, e-mail to management): the first without asking, further ones only after consent.
• AI assistant of the Staff App (only after switching on): answers questions about what the app already shows the person; for educators always with identifiers.
• Träger Autopilot: key figures of the facilities, staff data according to the level of each facility, reasons for absence only as a number; facilities with level "Off" are not included. Monthly report: summarised monthly key figures without personal names; can be switched off by the Träger.
• Help chat and AVV chat: your questions and product documentation or the AVV text; no operational data; not stored.
• Voice dictation (group tablet): recording only for conversion into text; it may contain children's voices, names and observations. The recording is never stored; the text is stored in the daily report.
• E-mail helper: your sample e-mails (they may contain parent correspondence) and your instruction; the draft is stored until you delete it and is never sent.
• Parent meeting: recording of up to 30 minutes only with consents stored beforehand, including that of at least one parent. The AI writes an internal report and a version for the parents; the report remains stored until you delete it; the recording is deleted after evaluation. The child's name and child data from the Software are not passed to the AI.
• AI text drafts (release texts, reply to the Träger): only your key points.
• Website builder and image generation: your details in the assistant (EU) and style details for images (global).
• Hazard AI, preview image, handbook draft, floor plan: topics and notes of the team, photos (floor plan and handbook photos are not stored). The preview image of a hazard topic is created automatically and can be switched off via the Träger block "outside the EU".
• AI translation (only at the "All" level): e-mails from the facility to parents (the Software replaces names, data, links and codes beforehand with placeholders), content of the Parent App (messages, appointments, blog, group reports, diary notes, with everything contained therein) and, at the push of a button by management, the topic of a meeting request back into German. Only the translation is stored, for at most 30 days, not the original. Push notifications are not translated.
• Internet research (Autopilot, Träger Autopilot, reply to the Träger, hazards): the AI can research a general question without names or details about persons via Google search and shows the sources. Google may store these search queries for up to three days.
• Image generator (only after release by the Träger and switching on): you describe an image and can upload reference images; you choose an EU model or a non-EU model, and the Software shows with each where it is processed. Reference images and text must not contain persons or personal data (for example freely usable images from the internet). You download the images; we store neither the images nor the reference images.
• Letters to parents: an uploaded letter goes in full to the AI, which replaces personal details with placeholders; only the cleaned template is stored. When writing and translating, the AI sees only placeholders, never names or details of children; the Software inserts the values. Sending by e-mail only with the admin password, with dispatch log; e-mails that could not be delivered appear as a notice without address.
• AI data guard (default on): checks texts to parents and the public before sending, first without AI against the names of the children, then with AI (child names replaced by placeholders). The data guard runs only at the "All" level; without AI credit only the name check without AI. The AI does not change the text; a critical text is sent only by management with the admin password. None of this is stored.

Storage with us: history of Autopilot and shift plan AI for the period of one to seven days chosen by the facility (default until the end of the calendar day); translations for at most 30 days; confirmed actions, changes of the shift plan AI, daily analyses and monthly reports until deletion after the end of the contract (AVV §8); e-mail drafts, parent meeting reports and consents until deletion by the facility; for each call, a usage record without content for the AI credit. Errors are sent to Sentry without chat, prompt, audio or image content (2.8).

Purpose: Advice, shift planning, information, evaluations for the Träger, product help, text creation, documentation of parent meetings, hazard assessment, illustration and room planning, in each case according to the level and the switches.

Legal basis: Art. 6(1)(b) GDPR within the scope of the processing commissioned by the Kita Träger; for recordings of parent meetings additionally the consent of the participants. The information dialogue before the first use of individual AI functions serves transparency and is not a consent under Art. 6(1)(a) GDPR. Details in Annex C of the AVV.

2.8 Error monitoring (Sentry)

To detect and remedy technical errors, we use Sentry (Functional Software, Inc.) on the EU region Frankfurt (FRA, Germany). Transmitted are error reports, stack traces and technical metadata. Chat content, prompts, audio and form data are not sent to Sentry; in the case of dictation errors, at most the byte size and MIME type. In addition, session replay is active: it records screen sequences of the web app for error reproduction, including on tablets and on the public pages for legal guardians (e.g. application portal, confirmation page). Texts and inputs are masked in this process; images and media are not recorded. Insofar as masking does not apply in an individual case, visible names may be contained. Storage in the EU region Frankfurt.

Distinct from this are application-specific error logs in the Kita database (error_logs). These may contain a person ID in the error context so that a technical incident can be assigned to the affected check-in or master data action. They remain on the German servers and are not transmitted to Sentry.

Purpose: Operational security, error remediation, quality assurance.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stable and secure operation) or Art. 6(1)(b) GDPR within the scope of the commissioned processing.

2a. Data subjects

• Children of the facility
• Parents / legal guardians
• Staff members of the facility
• Users of Träger accounts, including persons added by invitation
• Authorised pick-up persons
• Applicants for a childcare place (children and legal guardians)
• Invoice recipients for membership fees; payers for parent payments (only with a bank connection)
• Participants in recorded parent meetings
• Recipients of e-mail copies and forwardings

3. Camera and microphone

Check-in terminal: There the camera serves exclusively to recognise QR codes. Although it may remain permanently activated, there is no video surveillance: no recording or storage of image material, no observation or evaluation of persons or surroundings, no disclosure; recognition takes place locally on the device.

Photo of the child (optional): In the group view, staff can take a photo of a child with the camera or select a file, but only if the legal guardians have granted the release "Photo of the child on the Kita's devices". The photo is reduced in size on the device, stripped of location data, and only then stored.

Further photos (optional): For hazard topics, the floor plan and handbook drafts, photos can be taken or uploaded (see 2.7).

Microphone (optional): Voice dictation records only while the user actively starts it; the recording is only converted into text and is never stored. Management can record a parent meeting, only with the previously stored consent of at least one parent; the recording is deleted after evaluation.

4. Parent App and Staff App

The Parent App (separate app without a user account; use via a pseudonymous child code) offers optional functions such as push notifications and digital wallet cards. In addition, API requests of the Parent App (e.g. meal cancellations, absences, early pick-up, general messages, Kita status, poll votes) are forwarded via Cloudflare Workers to the Kita database (Supabase). Pseudonymised child IDs and Kita IDs are transmitted in this process. Poll votes are linked to a device ID so that only one vote is counted per device; the device ID serves exclusively this purpose. Check-in and check-out times of children are not processed via Cloudflare. These functions use additional service providers (Expo, Cloudflare) that are not used for the web app.

The Staff App (mobile phone, separate store app) sends its requests directly to the application in Frankfurt. Staff members see their working hours and the team's daily plan and can submit home-office check-in, absence and sick notices as well as messages of the internal team chat; a digital staff badge in a wallet is optional. Working-time corrections go as a change request to management, not into the team chat. The facility can switch off the app as well as individual functions (team chat, clocking in and out, messages to parents) in its settings (default: on). In the data protection mode "Private phones" (default setting), the app shows no master data of children and, for children, only numbers; in the mode "Work devices", which the facility selects only for its own devices, it may show names of children in the person's own group, insofar as a function requires them. The app shows child codes in no mode. Free texts from colleagues or management, and the topic of a meeting appointment named by parents, may contain information about children. Management can send a message to an individual person in that person's inbox in the app. The facility can switch on an AI assistant for the Staff App (default: off); staff can then ask questions about their data visible in the app (see 2.7). Push notifications are received only by those who have allowed them on their own device. We recommend operating the Staff App on facility-owned work devices.

Users of the Parent App and of the Staff App accept the privacy notices and terms of use of these apps within the app itself; without this consent the app cannot be used. The push notifications are also explained there; they can be switched off at any time in the device settings.

Full explanations: Privacy notice of the Parent App · Privacy notice of the Staff App.

5. Sub-processors and disclosure to third parties

Personal data are disclosed only in the following cases:

• For performance of the contract or operation of the app, to sub-processors (Art. 6(1)(b) GDPR)
• Upon a legal obligation (Art. 6(1)(c) GDPR)
• For a legitimate interest (Art. 6(1)(f) GDPR)
• With express consent (Art. 6(1)(a) GDPR)

The following sub-processors are used. A data processing agreement (DPA) exists with each of them:

The complete list with certifications is contained in Annex 1 of the AVV.

For audience measurement of the web app we use Vercel Web Analytics of our hosting provider Vercel (see table): aggregated page statistics, without cookies. We do not use tracking or advertising tools.

Meal supplier: If the optional supplier access is activated, the meal supplier named by the Träger can view meal notes (including allergy and dietary information). The supplier is a recipient acting on the instructions of the controller, not a sub-processor of 997 Ventures UG.

Bank connection (optional): If the facility connects its own bank account (e.g. with Qonto), Bienenstock retrieves transactions there on a read-only basis, on the instructions of the facility, in order to assign parent payments. The bank is a contractual partner of the facility, not a sub-processor of 997 Ventures UG. The name and IBAN of payers are retrieved in this process but not stored; only the payment reference, amount and booking date of assigned or still assignable incoming payments and of outgoing payments that the facility assigns to an occasion are stored. All other transactions are discarded.

Payment of the contract by credit card: If a Client (Träger or facility) pays the usage fee by credit card, Stripe Payments Europe, Ltd. (Ireland) processes the payment. For this purpose, Stripe receives name, e-mail address, invoicing details and the card data; only Stripe receives the card data, not us. No data of children, parents or staff are passed to Stripe. Stripe is an independent controller for this purpose, not a sub-processor. Legal basis: Art. 6(1)(b) GDPR.

6. Data transfers outside the EU

All core personal data of the web app are stored exclusively on servers within the European Union (main location: Supabase, Frankfurt/AWS). Serverless functions and data storage at Vercel as well as error monitoring (Sentry) are configured for Frankfurt. Technical e-mails (Brevo) are hosted at OVH in France and Germany; data storage at Brevo takes place at Google Cloud in Belgium. There is no configuration for permanent storage outside the EU.

Legal safeguards with respect to US parent companies: Supabase Inc., Vercel Inc., Functional Software, Inc. (Sentry) and Google (Vertex AI, as well as storage of technical e-mails at Google Cloud Belgium via Brevo) have their registered seat or parent company in the USA. Potential access possibilities - in particular under the US CLOUD Act - are safeguarded by the adequacy decision EU-U.S. Data Privacy Framework (Implementing Decision (EU) 2023/1795) and, additionally, by standard contractual clauses (SCCs) pursuant to Art. 46(2)(c) GDPR (Implementing Decision (EU) 2021/914). Core personal data are not permanently stored outside the EU.

Exception AI image generation: The optional image generation (website images, terminal logo, preview images of hazard topics) runs on the global Vertex endpoint and receives only image descriptions without personal reference, because Google does not offer image models on the EU multi-region. For the image generator, you choose between an EU model and a non-EU model; with the non-EU model, your free text and your reference images go there. For this data flow there is no EU residency commitment. The transfer basis is the DPF and SCCs with respect to Google; details in Annex C of the AVV.

Note on the mobile apps: For the separate Parent App (without account, pseudonymised) and the Staff App, additional services are used:

• Cloudflare (API relay of the Parent App, push dispatch of both apps) - EU data residency (Frankfurt / Cloudflare Regional Services and Cloudflare KV). API transit without access to the Supabase database. Permanently stored in Cloudflare KV for each facility: the parent password of the facility, the name of the facility, push tokens and device IDs with group assignment and the child identifiers stored on the device (so that child-related notifications reach only the devices of that child); wallet passes with the child's name for up to 5 minutes.
• Apple Push Notification service, Firebase Cloud Messaging, Expo - push delivery to iOS/Android via the Cloudflare push worker, only if the person has allowed notifications on their device. Types: traffic-light status changes (Parent and Staff App, only yellow/red, fixed texts, not for green, not on closing days/outside opening hours). Parent App: group message (title and text as entered by staff), message of the facility to one family (fixed title without text, only to the devices of that child), appointment reminder, parent meeting appointment, newly shared daily report or new note (without content and without names), and payment received (amount and occasion, no name of the child, only to the devices of that child). Staff App: team chat (name and text, depending on the marking, to the team, one group or one person), call to a person, automatic working-time notices (to the person concerned; "planned, but not present" to the staff of the group), staff appointment (without names). Partly global (US) infrastructure, technically mandatory due to the platform. Specialist data remain in Supabase Frankfurt. Message contents are only in transit, with no permanent storage at these services. No technical filtering of free texts takes place.

Cloudflare does not process check-in or check-out times of children or staff. Details on all sub-processors of the mobile apps can be found in the Privacy notice of the Parent App and the Privacy notice of the Staff App.

7. Cookies and similar technologies

We use only technically necessary cookies to ensure the functionality of the web app (e.g. session management, authentication).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest) for technically necessary cookies. Tracking or marketing cookies are not used.

8. Storage period

Personal data are stored only as long as this is necessary to achieve the purposes of processing or the controller (Kita Träger) instructs a longer storage.

In particular:

• Attendance data (drop-off and pick-up times): Retention periods for facility-related records, including for the occupancy of the facility, may result from the national law of the controller's Member State as well as from budgetary or tax rules. This obligation rests with the Träger as controller. We store the data on its behalf for as long as it determines and at the latest until the end of the contract. Before then, the Träger can export all data; afterwards we delete them (AVV §8).
• Discarded check-in actions: deliberately retained after deletion or archiving of the person concerned (documented retention for the traceability of terminal actions). They are deleted or returned together with the remaining contract data (AVV §8).
• Registration data: for the duration of the contractual relationship and 30 days after termination (data export period).
• Server logs: maximum 90 days, unless a security incident exists.
• Internal staff chat: automatic deletion after the retention period chosen by the facility (1 to 7 days, default 1 day), in each case at midnight in the time zone of the facility; this also applies to automatic notices in the chat. Pinboard messages are permanently excluded from this deletion and remain stored until they are removed manually or the contractual relationship ends.
• Group reports, daily reports and notices (free text): storage on German servers for as long as the Träger keeps them or the contractual relationship exists.
• Child notes, child photo, contact details of the legal guardians on the child record: for as long as the child record exists or the contractual relationship continues; the child photo is deleted upon withdrawal of the release. Notes and photo are optional; the content follows from the respective entry.
• Consent requests by e-mail: recipient address and check value of the link are deleted upon confirmation, upon replacement by a new request, or at the latest around one hour after the expiry of the one-hour link; unconfirmed requests after 30 days. Confirmed requests remain as evidence. The dispatch log of release and recording consent requests remains until the facility deletes it, at the latest until the end of the contract.
• Consents to the recording of a parent meeting: unused ones after 30 days, with the image of the signature; used ones remain with the meeting until the facility deletes them.
• Applications in the application portal: unconfirmed ones after seven days; rejected or withdrawn ones twelve months after completion.
• Failed password attempts: check values after around one hour.
• Bank transactions (with bank connection): payment reference, amount and booking date of stored transactions (see 5.) for as long as the Träger keeps them or the contractual relationship exists; name and IBAN never. Incoming payments sorted out by the facility retain only the transaction identifier and amount, so that they are not read in again.
• Dispatch log to legal guardians: evidence of which document or which meal billing receipt was sent when to which address; for as long as the Träger keeps it or the contractual relationship exists.
• Poll votes: with device ID (one vote per device); for as long as the poll or the contractual relationship exists.
• Application-specific error logs (error_logs): including person ID in the error context; on German servers, for as long as required for error remediation or the contractual relationship exists.
• AI functions: history of Autopilot and shift plan AI for the period of 1 to 7 days chosen by the facility (default until the end of the calendar day), followed by automatic deletion; translations for at most 30 days (only the translation, not the original); help chat, AVV chat, Träger Autopilot and the AI assistant of the Staff App without storage. Confirmed Autopilot actions, changes of the shift plan AI, daily analyses and monthly reports for as long as the Träger keeps them or the contractual relationship exists. E-mail drafts, reports on parent meetings and consents to recordings until the facility deletes them, at the latest until the end of the contract. Usage records without content for the AI credit until the end of the contract. Voice recordings never permanently. At Google only in case of suspected misuse, for up to 90 days (see 2.7).
• Dictation audio: voice input exclusively for transcription; the audio file is never stored. Only the transcribed text in the daily report on German servers, for as long as the Träger keeps it.
• Error reports (Sentry): technical events without chat, prompt or audio payloads, as well as session replay of the web app (texts and inputs masked, see 2.8), limited to the retention configured at Sentry in the EU region Frankfurt.

After termination of the contractual relationship, the data will be deleted or returned within 30 days, at the choice of the controller (see AVV §8). It is the responsibility of the Kita Träger to ensure, before deletion, compliance with its statutory retention obligations.

9. Distinction: mandatory data and voluntary data

Mandatory data (drop-off and pick-up times)

Drop-off and pick-up times are recorded at the check-in/check-out terminal in the Kita. This documentation is required by law (under the national law of the controller's Member State) and forms part of the care contract. Opting out is not possible.

Voluntary data (via the Parent App)

The Parent App works without a user account; use takes place via a pseudonymous child code from the Kita system. Parents enter names or contact details only if the facility switches on corresponding functions (e.g. reporting a new authorised pick-up person or requesting a meeting; both default off). Pseudonymised data remain personal data within the meaning of the GDPR. All information transmitted via the app - e.g. meal cancellations, pick-up notifications or other messages - is voluntary. There is no obligation to use the app. Details: Privacy notice of the Parent App.

Staff App

The Staff App is a separate store app for staff members (identifier/pseudonym, time reports, chat). Details: Privacy notice of the Staff App.

10. Data subject rights

As a data subject - and as a parent or legal guardian on behalf of your child - you are entitled to the following rights under the GDPR:

• Right of access (Art. 15 GDPR): You may request information about the stored data.
• Right to rectification (Art. 16 GDPR): You may have inaccurate or incomplete data corrected.
• Right to erasure (Art. 17 GDPR): Subject to statutory retention obligations of the Träger (Art. 17(3)(b) GDPR, e.g. under the national law of the controller's Member State).
• Right to restriction of processing (Art. 18 GDPR): You may request the restriction of processing.
• Right to data portability (Art. 20 GDPR): You may receive your data in a machine-readable format.
• Right to object (Art. 21 GDPR): Possible at any time for voluntarily transmitted data. For mandatory data, there is no right to object (Art. 6(1)(c) GDPR).
• Withdrawal of consent (Art. 7(3) GDPR): Consents given may be withdrawn at any time with effect for the future.

Responsibility: The respective Kita Träger is responsible for the data processing. 997 Ventures UG processes the data as processor exclusively on behalf of and on the instructions of the Kita. Requests concerning your rights should be directed to your Kita.

Right to lodge a complaint (Art. 77 GDPR): You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. For 997 Ventures UG as processor, the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (LfDI RLP) [verify] is competent. For processing by your Kita, the supervisory authority of the Träger is competent; in France, the Commission nationale de l'informatique et des libertés (CNIL) [verifiziert], in the Netherlands the Autoriteit Persoonsgegevens (AP) [verifiziert].

11. Data security

We apply comprehensive technical and organisational measures pursuant to Art. 32 GDPR:

• Encryption: TLS 1.2/1.3 for transmission (HTTPS only, no unencrypted interfaces), AES-256 for storage
• Access controls: Role-based access restriction, authentication; separation of data by facility at database level via row-level security (kita_id check) on every table. Träger accounts (including invited users) view and edit the data of the Kitas assigned to the Träger, not those of other Träger
• Availability: Regular backups, redundant infrastructure, DDoS protection
• Pseudonymisation: Child codes instead of real names in the Parent App; optional pseudonymised operation of the web app possible
• Review: Regular security audits, evaluation of the measures

Notification of personal data breaches: In the event of a breach of the protection of personal data, we will inform the controller without undue delay and at the latest within 24 hours of becoming aware of it, so that it can comply with its 72-hour notification obligation to the supervisory authority under Art. 33 GDPR.

Core data are stored exclusively on servers in the European Union. For the exception of the optional AI image generation (global endpoint), see 2.7. Detailed TOMs will be made available on request.

12. Protection of minors

Our web app is primarily aimed at parents or legal guardians and Kita staff. The processing of personal data of children takes place exclusively within the framework of the care relationship and on the basis of the care contract between the Kita and the parents or legal guardians.

13. Pseudonymisation

The Software offers the option of working with pseudonymised data of children and staff. In the Parent App, child codes are used by default instead of real names. For further pseudonymisation options in the web app, please contact info@bienenstock-kita.de.

14. Transparency information pursuant to Art. 13 & 14 GDPR

The Kita or the Träger is the controller for the data processing within the meaning of Art. 4 no. 7 GDPR and is therefore obliged to inform the data subjects (parents, staff) about the processing.

On our platform we provide a model form for transparency information. The processor assumes no liability for the completeness and lawfulness when this form is used.

15. Social data and notification pursuant to § 80 SGB X

Not applicable outside Germany.

16. Linked documents

The following documents form part of the data protection concept and supplement this notice:

• Data Processing Agreement (AVV) - incl. Annex 1 (sub-processors) and Annex C (AI functions)
• Privacy notice of the Parent App
• Privacy notice of the Staff App
• Terms of Use

17. Changes to this privacy notice

We reserve the right to amend this privacy notice as required. The current version is available at any time at beenest.co/eu/privacy.

For questions on data protection, please contact: info@bienenstock-kita.de