Privacy policy

This English text is a courtesy translation of our German privacy policy, which is the legally binding version. Status: October 2026.

Controller

Suzanne Busch
Kindertagespflege Windelflitzer
Kärntener Straße 29
10827 Berlin, Germany
Telephone: +49 30 94888967
Email: info@windelflitzer.info

We have not appointed a data protection officer.

Overview: what data do we process and why?

• Visiting the website: technical access data (server log files) at our hosting provider, data-minimising counting of page views without cookies.
• Place request via the form: details about the child and a parent as well as the desired care, so that we can contact you.
• Contact by email or telephone: your details, to answer your enquiry.
• Reviews and testimonials: first name, year and text of a testimonial, only with the author’s consent.
• External links: only once you click a link to a map or review service.

On the website we use no cookies for visitors, no advertising or tracking services and no embedded third-party content (maps, videos, fonts).

Legal bases

For each processing we state the legal basis. In essence there are four: your consent (Art. 6(1)(a), Art. 7 GDPR), initiating and performing a care relationship and answering your enquiries (Art. 6(1)(b) GDPR), legal obligations (Art. 6(1)(c) GDPR) and our legitimate interests, for example in operating the website securely and evaluating its use (Art. 6(1)(f) GDPR).

Hosting and server log files

Our website is hosted on servers of STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. STRATO provides storage space, computing power, email mailboxes and technical support and processes data on our behalf. A data processing agreement under Art. 28 GDPR is in place.

When our pages are accessed, the hosting provider’s server logs technical data such as the requested page, date and time, amount of data, browser and operating system, referrer, your IP address and your internet provider. We use this only for secure operation and to investigate misuse (legitimate interest). According to the hosting provider, IP addresses are stored for no longer than seven days and then deleted. The access logs are available to us for the last six weeks; after the first seven days they no longer contain IP addresses. The connection to our website is encrypted with HTTPS.

Data-minimising reach measurement without cookies

We count page views with a very simple solution on our own server. Counting takes place solely on the server when your browser requests a page: no script runs in your browser for this, we set no cookies for this, store nothing on your device and read nothing from your device. Only numbers are stored permanently, namely a counter per page, day and hour. We store no IP addresses and no browser identifiers.

Daily hash as a pseudonym: To estimate how many different devices visited the website on a day, the server briefly forms a hash from your IP address and browser identifier together with a random value that changes daily. This hash is a pseudonym, not anonymous data, so we treat it legally like personal data. It is kept in a list on the server for the current day only. The random value and the list are deleted the next day; afterwards the hash can no longer be assigned to anyone, and you cannot be recognised on another day. If you have “Do Not Track” or “Global Privacy Control” enabled, we count the page view but do not form a hash. Requests from search engines and other robots are not counted.

Further counters: Per day we count whether the first page called up was a German or an English one. If you scan the QR code on our door or on one of our flyers, we count per day and code how often it was used (again without cookies and without storing IP addresses); you are then forwarded to our home page. For the “most recently viewed” evaluation, the server also keeps for at most 36 hours a list of the page called up and the time (to the minute), without IP address and without browser identifier; older entries are deleted automatically.

Rough origin of visitors: To evaluate which regions interested people come from, the server briefly compares the IP address of a new daily visitor, in working memory only, with a local database (IP location data “IP to City Lite” from DB-IP.com, licence CC BY 4.0). No request is made to third parties, and the IP address is not transmitted to anyone. From the result we store only a counter per day and country or, in Germany, per federal state, never the IP address and never a city. Because of the nature of the data, the location is only a rough estimate. If you have “Do Not Track” or “Global Privacy Control” enabled, we do not determine an origin.

Legal basis and balancing of interests: We base the counting on our legitimate interest (Art. 6(1)(f) GDPR) in understanding which content parents are interested in and improving the website accordingly. The intrusion is slight: no cookies are set, no profiles are built, no data is passed on to third parties, and the hash exists for one day only. Since counting takes place only on the server and no information is stored on or read from your device, we consider that no consent under § 25 TDDDG is required. You can object to the counting (see “Right to object” below). We receive a weekly summary of figures without any personal reference (visitors, page views, place requests).

Place request (form)

If you request a place via our form, we process the details you enter:

• about the child: first name, last name, date of birth, optionally gender (so that we can put the group together as diversely and in as balanced a way as possible),
• about a parent: first name, last name, email address, optionally salutation and telephone number,
• about the care: desired start, desired hours, status of the Kita voucher,
• optionally a message with your questions,
• the time of your request and of your acknowledgement of this privacy information.

Required fields are marked with * in the form. Without these details we cannot process your request; all other details (for example salutation, gender, telephone number and message) are voluntary.

The data is transmitted to our server in encrypted form (HTTPS) and is not stored there, but forwarded by email to our mailboxes. To protect against misuse we use a hidden form field and a time lock; for this a shortened hash of your IP address is kept on the server for at most one hour and then deleted. We do not pass the data on to third parties and use it only to contact you and to process your request.

Confirmation email: after sending, we automatically send a confirmation to the email address you entered. It contains your details as a receipt, a note on how your data is handled and a link to this privacy policy. We use the address for this only once; you will not receive advertising or newsletters. Please note that emails are not always transmitted fully encrypted on their way to you. If you do not wish to receive the confirmation or it was triggered by someone else, please reply briefly; we will delete the details on request.

The legal basis is the performance of pre-contractual measures at your request (Art. 6(1)(b) GDPR); no consent is required for this. The voluntary information on gender serves to put the group together as diversely as possible. We keep requests that do not lead to a care relationship until the requested start of care, but no longer than 14 months, and delete them afterwards. On your simple request we delete the data earlier. If a care relationship is concluded, further processing follows the care contract and statutory retention obligations.

Please do not enter any information about the child’s health or other sensitive information in the form; we discuss such matters in person if needed.

Question form and call-back

If you write to us via the question form, we process your question and, if you provide them, your name, telephone number and email address. We need at least the question and either a telephone number or an email address in order to answer you; all other details are voluntary. We use the details solely to answer your question or to call you back at your request. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) and, where your enquiry is not aimed at a contract, Art. 6(1)(f) GDPR (our interest in answering questions from interested parties). The details are sent to us by email and are not stored on the web server. We delete them as soon as your matter is dealt with, at the latest after six months, unless statutory retention duties apply. They are not passed on to third parties. Please do not give any details about your child’s health.

Contact by email or telephone

If you contact us by email or telephone, we process your details to handle the enquiry (Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR). We delete enquiries as soon as they are no longer required, at the latest 14 months after the last communication. Statutory retention obligations remain unaffected. Please note that emails are not protected against access by third parties throughout their transmission.

Testimonials and reviews on the website

On the “Reviews” page we show statements from parents who sent us Google reviews, thank-you cards or letters. We publish them only with the explicit consent of the authors (Art. 6(1)(a) GDPR) and show at most the first name and the year, never names or pictures of children. English versions on this website are translations. You can withdraw consent at any time with effect for the future (email to info@windelflitzer.info); we then remove the contribution from the website without delay.

External links (maps, routes, reviews)

On the “Directions” page we show a map section as an image from our own server; no connection to a map service is made. The map data comes from OpenStreetMap (© OpenStreetMap contributors, ODbL).

Only when you click one of the following links do you leave our website, and the respective provider technically receives your IP address and further connection data. The provider is responsible for the processing there:

• “Start route”: opens your maps app from Apple (Apple Maps, Apple Distribution International Ltd., Ireland) or Google (Google Maps, Google Ireland Limited; data may also be processed in the USA).
• “Reviews on Google”: opens our entry on Google Maps (Google Ireland Limited).
• The link to the map data licence leads to OpenStreetMap (OpenStreetMap Foundation).

Cookies, local storage and fonts

When you visit the public pages we set no cookies. There is only a single storage on your device: if you close the language notice (the bar that offers a page in the other language), your browser remembers this until the end of the session in session storage (sessionStorage) so that the notice does not appear again. This is strictly necessary for this function requested by you (§ 25(2) no. 2 TDDDG), and no data is transmitted to us. Otherwise we store no information on your device. The fonts used (Fredoka, Nunito; both under the SIL Open Font License) are loaded from our own server; nothing is requested from font providers. For an internal area that is accessible only to us as operator (evaluation of the counting), a technically necessary session cookie is set after login. It is deleted when the browser is closed and used only for that area (§ 25(2) no. 2 TDDDG).

Recipients and transfers to third countries

Recipients of your data are ourselves and our hosting provider as processor (Art. 28 GDPR). Beyond that we pass on data only if there is a legal permission or obligation or you have consented. We ourselves do not transfer data to countries outside the European Union or the European Economic Area. A transfer to third countries can only occur if you click a link to an external provider yourself (see “External links”).

Storage period

We store data only as long as necessary for the respective purpose; concrete periods are stated for each processing, for example for place requests. Afterwards we delete the data. Where statutory retention obligations apply, we restrict the data and use it only for that purpose until the period has expired. Such obligations result in particular from the German Fiscal Code (§ 147 AO), where they apply to us, for example eight years for accounting vouchers, six years for business letters and ten years for books and records.

Your rights

You can request information about whether and which data we process about you (Art. 15 GDPR), have inaccurate data corrected (Art. 16), request erasure (Art. 17) or restriction of processing (Art. 18) under the statutory conditions, and receive the data you provided in a common format or have it transferred to another controller (Art. 20).

Withdrawal of consent: you can withdraw consents given at any time with effect for the future (Art. 7(3) GDPR). The lawfulness of the processing carried out until then remains unaffected. Write to info@windelflitzer.info.

No automated decision-making: there is no solely automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Right to complain: you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). Our competent authority is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany.

Security measures

We protect your data with technical and organisational measures appropriate to the risk (Art. 32 GDPR). These include encrypted transmission via HTTPS, not storing form data on the web server, password protection for the internal statistics area with a lock after several failed attempts, and access protection for our mailboxes. We collect only the details we need for the respective purpose.

Changes

We adapt this privacy policy when the website or the legal situation changes. The current version applies. Status: October 2026.