Privacy policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

• i-ruck GmbH
• Mangstraße 15
• 80997 Munich
• Germany
• Commercial register: Munich local court, HRB 165067
• Managing directors: Mark Nibbe, Andreas Kutzer
• Email: support@kulibri.com

2. Data protection officer

We have not appointed a data protection officer, because fewer than 20 people are permanently engaged in the automated processing of personal data (Section 38 of the German Federal Data Protection Act, BDSG).

3. Data processing on the website kulibri.com

3.1 Server log files

When you access our website, your browser automatically transmits information to our server, which is stored temporarily in log files:

• IP address (anonymised after the storage period expires)
• Date and time of access
• Name and URL of the retrieved file
• Referrer URL
• Browser and operating system

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in the security and stability of the operation). Storage period: 14 days. Storage beyond that is only possible in the event of a concrete suspicion of attacks or for error analysis.

3.2 Cookies

We use only technically necessary cookies. These are required for the operation of the website and cannot be disabled without restricting its functionality. We do not use advertising cookies, analytics cookies or tracking cookies. No data is transmitted to third parties.

Legal basis: Section 25 (2) TTDSG (technically necessary cookies, German Telecommunications-Telemedia Data Protection Act); insofar as personal data is processed, Art. 6 (1) (f) GDPR.

3.3 Website statistics

Matomo is not planned for the new website. The counting of app usage is separate from the website.

Checkpoint before publication: The tool for website statistics has not yet been decided. As soon as the tool and hosting are fixed, the data actually collected, recipients, storage period and legal basis must be added here. The statements on cookies and hosting must also be reconciled with the final setup.

4. Data processing in the app (app.kulibri.com)

kulibri is a service for group organisation. We process data in two different roles:

• As controller: for data we collect ourselves to provide the service (registration, payment processing, support).
• As processor: for personal data that an admin processes in the context of a poll (participant data, question fields). In this context the admin acts as controller.

4.1 Registration (admin account)

When you register, we collect:

• Email address
• Name or pseudonym (freely selectable, no full name required)
• Password (stored as a hash, not in plain text)
• Time of registration

Legal basis: Art. 6 (1) (b) GDPR (performance of the contract). Storage period: until the account is deleted by the user, plus statutory retention periods.

4.2 Polls and participant data

When an admin creates a poll, kulibri processes personal data of the participants on behalf of the admin. The exact type of data collected is determined by the admin through the design of the poll (mandatory fields, optional question fields). kulibri processes only the information that is necessary to provide the service.

Typical participant data:

• Name (entered by the admin or the participant)
• Email address (if provided or entered by the admin)
• Answers to poll questions
• If created by the admin: answers to individual fields (e.g. T-shirt size, allergies or similar)

For this processing, the admin is the controller under data protection law. Organisations are obliged to conclude a data processing agreement (DPA) with kulibri.

Deleting polls: Admins can delete their polls themselves at any time. A deleted poll is immediately inaccessible to everyone, neither via its link nor in the dashboard. We keep the associated data for another 30 days so that a poll deleted by mistake can be restored on request. After that we remove all personal information: title and description, names, email addresses, comments, answers to question fields and other free text. Only anonymous information without reference to individual persons remains, such as when the poll was created, which subject area it belonged to (e.g. sports or school) and how many people answered and how. We use this anonymous information to improve kulibri. On request we also anonymise a poll immediately; an email to support@kulibri.com is sufficient. Our data backups contain the data for up to 14 days.

4.3 Email delivery (invitations and notifications)

When an admin sends invitations via kulibri or activates notifications, the email addresses of the participants provided by the admin are used for delivery. In this context, the admin is the controller for the email addresses entered; kulibri acts as a technical service provider.

For technical delivery we use Brevo (formerly Sendinblue), Brevo SAS, 7 rue de Madrid, 75008 Paris, France. A data processing agreement is in place with Brevo.

Legal basis: Art. 6 (1) (b) GDPR (performance of the contract).

4.4 Payment processing (Premium)

We use Mollie to process payments:

• Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands

Mollie is an EU payment service provider and processes payment data (card data, IBAN etc.) exclusively for the purpose of payment processing. kulibri does not store any payment data itself. A data processing agreement is in place with Mollie. Further information: https://www.mollie.com/en/privacy

Legal basis: Art. 6 (1) (b) GDPR (performance of the contract). Storage period: in accordance with tax retention requirements (10 years, Section 147 of the German Fiscal Code, AO).

5. Hosting and server location

kulibri is operated exclusively on servers in Germany.

• Hosting provider: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.

A data processing agreement is in place with Hetzner. No transfer of personal data to countries outside the European Union or the European Economic Area takes place, unless expressly stated in this statement.

6. Disclosure to third parties

We only disclose personal data if:

• there is express consent (Art. 6 (1) (a) GDPR),
• it is necessary for the performance of the contract (Art. 6 (1) (b) GDPR),
• there is a legal obligation (Art. 6 (1) (c) GDPR), or
• we use processors with whom a DPA is in place.

We do not sell personal data. We do not use user data for the advertising purposes of third parties.

Processors we use:

7. Data processing agreement (DPA)

In commercial use, kulibri acts as a processor within the meaning of Art. 28 GDPR. Organisations (clubs, schools, companies, kindergartens, authorities) that use kulibri to process the personal data of third parties can conclude a data processing agreement with us.

Private users who use kulibri exclusively for personal or family purposes do not need a DPA in accordance with Art. 2 (2) (c) GDPR.

To request a DPA, please contact: support@kulibri.com

8. Rights of data subjects

You have the following rights regarding your personal data:

• Access (Art. 15 GDPR): which data we store about you.
• Rectification (Art. 16 GDPR): correction of inaccurate data.
• Erasure (Art. 17 GDPR): deletion of your data, unless retention obligations apply.
• Restriction (Art. 18 GDPR): restriction of processing under certain conditions.
• Data portability (Art. 20 GDPR): receipt of your data in a machine-readable format.
• Objection (Art. 21 GDPR): objection to processing based on legitimate interests.
• Complaint (Art. 77 GDPR): complaint to the competent supervisory authority.

Competent supervisory authority: Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de

To exercise your rights, contact: support@kulibri.com

9. Deleting your account and inspecting your data

Registered users can delete their kulibri account themselves at any time in the account settings. In doing so, we immediately remove the account data (name and email address), contacts, your own designs, images and logos as well as participations in other users' polls. Your own polls are handled as described in section 4.2 and anonymised after 30 days. We keep invoices for the statutory period of 10 years (Section 147 AO). Alternatively, you can contact support@kulibri.com.

If you would like to inspect the data we have stored in your account, or request a copy of your data, contact: support@kulibri.com

10. Data security

We use HTTPS with SSL/TLS encryption for all connections. Passwords are stored exclusively as cryptographic hashes.

11. Special categories of personal data

Via the free question fields of a poll, admins can ask questions whose answers constitute special categories of personal data within the meaning of Art. 9 GDPR (e.g. allergies, health restrictions).

kulibri stores this data technically, but is not responsible for the content of the questions or the lawfulness of the processing — that responsibility lies with the admin as controller.

12. Currency of this statement

This privacy policy has the status: 1 September 2026. We reserve the right to update this statement to reflect changes to our offering or the legal situation. The current version is available at kulibri.com/en/privacy; the German version at kulibri.com/de/datenschutz prevails.