Privacy Policy

1. Data protection at a glance

General information

The following notices provide a simple overview of what happens to your personal data when you visit this website or purchase our products. Personal data is any data by which you can be personally identified.

Data collection on this website

Who is responsible for data collection?
The controller within the meaning of the GDPR is NUNIVIA GbR (Fabrice Ortner and Dr. Lucia Weiger), Rathausstr. 7, 79872 Bernau, Germany. Further contact details can be found in the legal notice (Impressum).

How do we collect your data?
Through your entries (e.g. email form, order process) and automatically through technical systems when the site is accessed (IP address, browser, operating system, time). When you make a purchase, your email address, the selected item, and your consents are logged.

What rights do you have?
Access, rectification, erasure, restriction of processing, data portability, objection, withdrawal of consent, and the right to lodge a complaint with the competent supervisory authority — for NUNIVIA this is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW). No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place. Please submit erasure requests to [email protected].

Is there a data protection officer?
No. We are not legally required to appoint a data protection officer (Art. 37 GDPR, § 38 BDSG), as fewer than 20 people are permanently engaged in the automated processing of personal data and our core activity involves neither extensive monitoring nor the processing of special categories of data. Please direct privacy enquiries to [email protected].

2. Hosting & network infrastructure

Web hosting (Vercel)

This website is hosted by Vercel Inc., 340 Pine Street, Suite 401, San Francisco, CA 94104, USA. Details: Vercel Privacy Policy. Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in secure, high-performance hosting). The transfer of data to the USA takes place on the basis of the EU Standard Contractual Clauses (Art. 46 para. 2 lit. c GDPR).

DNS & network security (Cloudflare)

Our domain is operated via Cloudflare Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare acts as a DNS resolver and network proxy and, in doing so, processes the IP addresses of incoming requests for DDoS defence and load distribution. Details: Cloudflare Privacy Policy. Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in secure, available operation). The transfer of data to the USA takes place on the basis of the EU Standard Contractual Clauses (Art. 46 para. 2 lit. c GDPR).

3. Payment processing (Stripe)

Purchases on this website are processed via Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin D02 H210, Ireland. Stripe processes payment data (credit card, SEPA, name, email) exclusively for the performance of the contract. Details: Stripe Privacy Policy. Legal basis: Art. 6 para. 1 lit. b GDPR (performance of contract). We do not store any credit card data — processing takes place exclusively at Stripe.

During the checkout process, we additionally log your consents (e.g. agreement to the GTC, optional consent for reminder or marketing emails) with a timestamp. Incomplete checkout processes are automatically deleted after 30 days (Art. 5 para. 1 lit. e GDPR).

4. Database (Supabase)

Purchase and consent data is stored in a database at Supabase Inc., 548 Market St PMB 16063, San Francisco, CA 94104, USA. The data is hosted in the AWS region EU-West (Ireland) and does not leave the EU. Details: Supabase Privacy Policy. Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in secure data storage and proof of purchase). Proofs of purchase are retained for 10 years pursuant to § 147 AO (anonymised following a GDPR erasure request).

5. Email marketing (Brevo)

If you request our family checklist, request the device-protection guide, or consent to the newsletter when making a purchase, we process your email address in order to send you content and to inform you about NUNIVIA news. Processing takes place on the basis of your consent (Art. 6 para. 1 lit. a GDPR). You can withdraw your consent at any time — via the unsubscribe link in every email or by request to [email protected].

Family checklist (free offering): On the /checkliste page and via the sign-up form on our homepage, we provide the detailed step-by-step instructions and the printable version of the checklist in exchange for your email address. By signing up, you also consent to receiving tips on digital family safety from NUNIVIA by email. This link is voluntary: even without signing up, you can view the overview of the ten measures (title and short description) free of charge; consent is not pre-selected. The legal basis is your consent (Art. 6 para. 1 lit. a GDPR). Activation takes place using the double opt-in procedure: you first receive a confirmation email and are only added to the distribution list after your confirmation. To document your consent, we store the consent text including its version, the timestamp, and your IP address (exclusively as a SHA-256 hash, not in plain text).

For the device-protection guide form (/geraet), we additionally store the selected device platform (iOS/Android/Both) as a contact attribute in order to be able to send you the appropriate guide as well as set-up tips and information about NUNIVIA offerings. If you indicate interest in the paid setup service (non-binding waitlist), we also store this as a contact attribute so we can inform you about it specifically.

If you enter your email address on one of our game-review pages (e.g. /spielbewertung/roblox), we additionally store the respective requested game as a contact attribute (game_slug) in order to inform you specifically about the risks of this game and matching NUNIVIA offerings. Activation takes place using the double opt-in procedure: you first receive a confirmation email and are only added to the distribution list after your confirmation. To document your consent, we store the consent text including its version, the timestamp, and your IP address (exclusively as a SHA-256 hash, not in plain text).

We use Brevo (Sendinblue SAS, 55 rue d'Amsterdam, 75008 Paris, France) for sending emails. Your data is transmitted exclusively server-side and is not processed in the browser. Details: Brevo privacy policy.

5b. Recommended third-party providers (AdGuard DNS)

On our /geraet page, we recommend AdGuard DNS as a technical solution for device protection while on the move. If you create your own AdGuard account via our link, this takes place directly with AdGuard. NUNIVIA receives neither account data nor DNS logs from your account from AdGuard. Only AdGuard's privacy policy applies to the processing within the scope of your AdGuard account: AdGuard privacy policy.

Affiliate notice: If you switch to AdGuard via our recommendation link, we receive an affiliate commission from AdGuard. The price does not change for you. The commission is recorded via a tracking parameter in the link URL — NUNIVIA does not set its own cookie or tracking pixel on your device in the process. Attribution takes place exclusively through AdGuard's own affiliate system. Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in remuneration for recommendation services). The affiliate link is subject to § 25 TDDDG; as NUNIVIA itself does not store or read out any information on your device, no separate consent on your part is required.

5d. Automatic DNS protection check (Internet-Schutzschild setup)

In the setup wizard for the Internet-Schutzschild, you can click to automatically check whether your DNS filter is active.

How it works: Your browser makes test calls to a few well-known adult and advertising domains (pornhub.com, xvideos.com, doubleclick.net) as well as its own control address. If your DNS filter blocks these domains, the calls fail — we interpret this as "filter active". If they succeed, the filter is not (yet) active.

Data processed: The call is made directly from your browser, not via our servers. If your filter is not active, the respective domain operator (see recipients) briefly sees your IP address — as with any normal page visit. NUNIVIA itself does not store any personal data for this; only the check result (active/not active) is remembered locally in your browser (localStorage).

Purpose: Immediate, understandable feedback on whether the DNS setup was successful, without you having to test it manually on a device.

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in a functioning, user-friendly setup check). The check only starts when you actively click it, never automatically in the background.

Recipients: If your DNS filter does not block the test addresses, the requests briefly reach the servers of Pornhub (Aylo), xvideos.com and Google/DoubleClick — each only a technical connection attempt (favicon fetch), no further data is transmitted by NUNIVIA.

Retention period: No server-side storage by NUNIVIA. The local check result remains until you reset it or clear your browser data.

Note: For the "Protection only" profile (Quad9, no content filtering), this automatic check does not run — there you confirm the setup manually.

6. Transactional emails (Resend)

After a successful purchase and in the case of withdrawal processes, we send confirmation and access emails via Resend Inc., 2261 Market Street #4613, San Francisco, CA 94114, USA. In doing so, your email address and the order reference are transmitted. The transfer of data to the USA takes place on the basis of the EU Standard Contractual Clauses (Art. 46 para. 2 lit. c GDPR). Details: Resend Privacy Policy. Legal basis: Art. 6 para. 1 lit. b GDPR (performance of contract).

6b. Contact and consultation enquiries (NUNIVIA CLUB)

If you request an initial consultation via the form on our CLUB page, we process the following data:

• Name and contact person
• Name of the organisation / association
• Email address
• Free text (optional)
• IP address (stored as a SHA-256 hash, not in plain text)
• Timestamp and version of the consent text

Purpose: Processing and answering your enquiry as well as internal proof of consent. The data is not used for advertising purposes.

Legal basis: Art. 6 para. 1 lit. a GDPR (consent) for the processing of your contact data. You can withdraw your consent at any time with effect for the future ([email protected]). The enquiry data is deleted after 6 months at the latest, provided that no contractual relationship arises.

Recipients: Resend Inc. (San Francisco, USA) for the internal notification email to NUNIVIA — legal basis: EU Standard Contractual Clauses (Art. 46 para. 2 lit. c GDPR). Supabase Inc. (Dublin, EU) for the consent log in the database — legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in proving the consent given, Art. 5 para. 2 GDPR). The complete data processing agreements (DPA) have been concluded with both providers.

Note: This page is addressed exclusively to organisations in the Federal Republic of Germany (§ 72a SGB VIII). Different legal bases apply to Austria and Switzerland — we cannot provide any guidance on these.

6c. Werkstatt cloud backup (NUNIVIA CLUB & SCHOOL)

The Schutzkonzept-Werkstatt saves your progress locally in your browser by default. You can optionally enable a cloud backup to continue across devices.

Data processed: When the cloud backup is enabled, we store your own email address, your organisation's name, and the content of the Werkstatt modules (e.g. risk analysis, rule texts, communication drafts). Names, email addresses and phone numbers of third parties (e.g. child-protection team members, the reporting contact person, background-check-responsible persons) remain exclusively local in your browser and are never transmitted to the cloud.

Note on free-text fields: Free-text fields (e.g. "other risks", the parent-letter draft, crisis-plan steps) are part of the Werkstatt content and are backed up as well. Please do not enter third-party names there — a corresponding notice appears directly in the Werkstatt.

Purpose: Continuing Werkstatt progress across devices (e.g. after a device change or deleted browser data).

Legal basis: Art. 6 para. 1 lit. a GDPR (consent) — the cloud backup is an active opt-in and disabled by default. You can withdraw your consent at any time by deleting the cloud backup in the Werkstatt area.

Recipients: Supabase Inc. (Dublin, EU) for storing the cloud backup — DPA concluded (Art. 28 GDPR). Resend Inc. (San Francisco, USA) for sending resume and delete-confirmation links — legal basis: EU Standard Contractual Clauses (Art. 46 para. 2 lit. c GDPR).

Retention period: Cloud backups are automatically deleted after 12 months without an update. Manual deletion is possible at any time via "Delete cloud backup" in the Werkstatt area.

No data processing agreement needed for third-party data: The cloud backup is deliberately designed so that it does not require any personal data of third parties: structured details about third parties (names, email addresses, phone numbers) are removed automatically before transmission and remain exclusively local in your browser. Here, NUNIVIA generally only processes your own contact data and your organisation's content on the basis of your consent, acting as the controller — not as a processor. A data processing agreement between you and NUNIVIA is therefore not required. Please observe the note on free-text fields above to help ensure this in practice.

7. Cookie consent management

We manage your cookie consent via our own cookie banner. Your decision is stored exclusively locally in your browser (local storage, key nunivia-cookie-consent) and is not transmitted to external servers. Analytical cookies are only set after you have actively consented. You can change or withdraw your consent at any time via the "Cookie settings" link in the page footer. Legal basis: Art. 6 para. 1 lit. a GDPR in conjunction with § 25 para. 1 TDDDG (consent).

We do not use an external consent management tool or any external provider to generate or host this privacy and cookie information — we maintain this page ourselves. A complete overview of all cookies and local storage technologies in use can be found in the following section.

8. Cookies and local storage in use

The following overview lists all cookies and comparable storage technologies (e.g. local storage) used on this website. "Until deleted in your browser" means the information is retained until you delete it yourself or change your cookie settings.

Technically necessary cookies and storage operations are required for the operation of the website and for functions you have expressly requested (e.g. access to purchased content) and do not require consent (§ 25 para. 2 no. 2 TDDDG).

Analytics technologies are only activated after your consent (Art. 6 para. 1 lit. a GDPR in conjunction with § 25 para. 1 TDDDG). You can withdraw this consent at any time via the "Cookie settings" link in the page footer.

9. Analytics

We use Vercel Analytics and Speed Insights for anonymous usage statistics. These tools are only loaded if you have consented to the use of analytics cookies. Legal basis: consent (Art. 6 para. 1 lit. a GDPR). You can withdraw your consent at any time via the cookie banner.

10. AI-powered features (Mistral AI)

On this website, we offer AI-powered features: the AI game recommendation (free-text description of the child → matching game suggestions) as well as — for course holders — the NUNIVIA Eltern-Coach (questions on digital media education).

For these features, the text you enter is transmitted to our AI service provider:

Mistral AI SAS, 15 rue des Halles, 75001 Paris, France (EU)

Mistral AI acts as a processor pursuant to Art. 28 GDPR. A data processing agreement (DPA) is in place. As Mistral AI is based in the EU, no third-country transfer is required.

Which data: The free text you enter (game description or education question) as well as, optionally, the child's age as an age band (e.g. "9–12 years"). The real names of children are technically not collected; we ask you not to enter any names or sensitive personal data in the input field.

Purpose: Generation of an individual game recommendation or coaching answer on media education.

Legal basis: Art. 6 para. 1 lit. b GDPR (performance of contract / provision of the requested service) or lit. f GDPR (legitimate interest in providing a helpful feature).

Retention period: We do not store the entered texts on our servers. The processing duration at Mistral AI is governed by the concluded DPA (no training on customer data).

Transparency (EU AI Act Art. 50): The answers of these features are generated by an AI system and are recognisable as such. Recommendations serve as guidance and do not replace pedagogical or professional advice.

11. Information for users from Switzerland (revDSG)

Insofar as users from Switzerland use our offerings, the revised Swiss Federal Act on Data Protection (revDSG, in force since 1 September 2023) applies additionally. The controller within the meaning of the revDSG is the contact address named in section 12. Data subject rights under the revDSG — in particular access (Art. 25 revDSG), rectification and erasure (Art. 32 revDSG), and objection (Art. 30 revDSG) — can be asserted via [email protected].

Swiss representative (Art. 14 revDSG): NUNIVIA primarily directs its offering at the German market and does not currently conduct any active marketing in Switzerland. We therefore do not appoint a representative in Switzerland pursuant to Art. 14 revDSG. As soon as this changes, this section will be updated.

12. Contact

If you have questions about data protection: [email protected]

Governing language version

This English text is a translation provided for your convenience. The German-language version of this privacy policy is the sole legally binding version. In the event of any discrepancy or contradiction between the German and the English version, the German version shall prevail.