Privacy policy

TukToro Privacy Policy 

Note on this translation

This English version of our privacy policy is a convenience translation. Only the German version is legally binding. In the event of any discrepancy or inconsistency between the German and the English version, the German version shall prevail.

Privacy Policy

We, a2zebra GmbH, operate https://tuktoro.com and collect certain data from you where this is necessary. In the following privacy policy, you will learn what we do with your data, known as personal data, and why we do so. We also explain how we protect your data, when the data is deleted and what rights you have under data protection law.

Who can I contact?

The controller responsible for this website is:

a2zebra GmbH
Bouchéstraße 12, Halle 20
12435 Berlin
Germany
privacy@a2zebra.de

Using these contact details, you can also reach our data protection officer at Fresh Compliance GmbH or another data protection contact. Please contact us at any time if you have specific questions about your data, its deletion or your rights.

What are my rights?

You can contact us at any time if you have questions about your data protection rights or wish to exercise any of the following rights:

  • Right to withdraw consent pursuant to Art. 7(3) GDPR (e.g. you can contact us if you wish to withdraw consent you previously gave for a newsletter)
  • Right of access pursuant to Art. 15 GDPR (e.g. you can contact us if you would like to know what data we have stored about you)
  • Right to rectification pursuant to Art. 16 GDPR (e.g. you can contact us if your email address has changed and you would like us to replace the old email address)
  • Right to erasure pursuant to Art. 17 GDPR (e.g. you can contact us if you would like us to delete certain data we have stored about you)
  • Right to restriction of processing pursuant to Art. 18 GDPR (e.g. you can contact us if you would like us not to delete your email address but to use it only for sending strictly necessary emails)
  • Right to data portability pursuant to Art. 20 GDPR (e.g. you can contact us to receive the data we have stored about you in a compressed format, for instance because you wish to provide the data to another website)
  • Right to object pursuant to Art. 21 GDPR (e.g. you can contact us if you do not agree with any of the advertising or analytics methods described here)
  • Right to lodge a complaint with the competent supervisory authority pursuant to Art. 77(1) GDPR (e.g. you can also address complaints directly to the data protection supervisory authority of your German federal state: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html)

Deletion of data and storage period

Unless stated otherwise, we delete your data as soon as it is no longer needed, e.g. your email address after you unsubscribe from our newsletter. Your data will also be blocked or deleted when a retention period expires. Certain data may have to be retained for longer for legal reasons. You can, of course, request information about the stored data at any time. Data protection requests and other legal matters may also be stored for a longer period within the scope of the legally relevant retention and limitation periods.

Visiting the website

If you merely want to browse our website, we do not collect any personal data, with the exception of the data your browser transmits to enable your visit to the website, in particular:

  • IP address (e.g. 81.91.215.example or 2a02:8109:9440:1198:bdb1:551f:example)
  • Approximate location based on IP range (e.g. Berlin)
  • Internet service provider (e.g. Vodafone or Deutsche Telekom)
  • Internet speed (e.g. 120 Mbit)
  • Date and time (e.g. 11:55 on 25 May 2023)
  • Previously visited website (e.g. google.de)
  • Browser (e.g. Chrome or Safari)
  • Operating system (e.g. Mac OS)
  • Hardware (e.g. Intel processor)

As a measure to protect your privacy, we delete or anonymise the IP address after your visit to our website. As a result, the other technical data can no longer be traced back to you and serves only anonymous statistical purposes for optimising our website. The purpose of temporarily storing the data is, on the one hand, the technical necessity of establishing the connection and, on the other, the correct and error-free display of our website. The IP address and the technical data mentioned above are required to display the website, to avoid display problems for visitors and to resolve error messages. The legal basis is so-called legitimate interest, which has been assessed within the framework of the aforementioned protective measures and in accordance with European data protection requirements under Art. 6(1)(f) GDPR.

Contact

You can get in touch with us via our contact form or by other means. You may provide us with the following data:

  • Name
  • Email address
  • Message

As a protective measure, contact – just like visiting the rest of the website – takes place over an encrypted connection. You may also choose other ways of contacting us. Once contact has been successfully established and your enquiry has been completed, your data will be deleted. The sole purpose of the data requested is to get in touch and communicate with you, which is why the data is used only for this purpose. The legal basis is so-called legitimate interest, which has been assessed for pursuing this purpose, within the framework of the aforementioned protective measures and in accordance with European data protection requirements under Art. 6(1)(f) GDPR.

Online orders

If you wish to order our products, we only ask you for the data required to process your order and payment. This data is treated confidentially and processed only by us, our technical service providers, the payment provider and the shipping service provider. At least the following data is required for this:

  • Contact (email or mobile phone number)
  • Country/region
  • First name/last name
  • Company (optional)
  • Address
  • Contact details
  • Payment details/payment method

Depending on the payment service provider you select, we pass the payment details required to process the payment on to the relevant credit institution or payment service provider. In some cases, you can create an account with the payment service provider itself or log in with an existing account. In these cases, the privacy policy of the respective service provider applies.

The shop is operated via Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Further information can be found in Shopify's privacy policy.

  • Shop Pay, operated by Shopify International Ltd., 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland. Shop Pay enables an accelerated checkout by using previously saved payment details. Further information can be found in Shopify's privacy policy.
  • Stripe, operated by Stripe, headquartered at The One Building, 1 Grand Canal Street Lower, Dublin 2, Ireland. Stripe processes the data required for the payment transaction within the European Union, but may also transfer it to other countries (in particular the USA). Appropriate safeguards pursuant to Art. 46 GDPR (standard contractual clauses, adequacy decision, EU-U.S. Data Privacy Framework) are in place for these transfers. Further information can be found in Stripe's privacy policy.
  • PayPal, operated by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. If you select “PayPal” as your payment method, the data required to process your payment will be transmitted to PayPal. PayPal reserves the right to carry out a credit check for certain payment methods. Further information on data processing by PayPal can be found in PayPal's privacy policy.
  • Apple Pay, operated by Apple Inc., Infinite Loop, Cupertino, CA 95014, USA. When you pay with Apple Pay, the payment is processed via the Apple Wallet function on your device. Only pseudonymised transaction data is processed; Apple does not store complete credit card details. Further information on data processing by Apple can be found in Apple's privacy policy.
  • Google Pay, operated by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. When you use Google Pay, the payment information is transmitted via your Google account. In doing so, Google processes, among other things, information about the transaction, the payment method used and device information. Processing takes place within the European Union, but data may also be transferred to other countries (in particular the USA). Appropriate safeguards pursuant to Art. 46 GDPR (standard contractual clauses, adequacy decision, EU-U.S. Data Privacy Framework) are in place for these transfers. Further information can be found in Google's privacy policy.

As a protective measure, the data you enter is transmitted – just like visiting the rest of the website – over an encrypted connection. We also apply the principle of data minimisation and collect only the data that is actually required. Your data is stored for as long as this is necessary to process your order or until you request its deletion. However, invoice-related data is subject to statutory retention periods and may be retained for up to ten years. The purpose of the data requested is to process orders and payments in order to provide you with the desired product. The legal basis is the performance of the mutual contract in accordance with European data protection requirements under Art. 6(1)(b) GDPR.

Registration for retail partners

As a retail partner, you currently have two options for registering on our website and then logging in to a user account at any time. The following data is required to register with us:

  • Company*
  • Website
  • Address line 1*
  • Postcode*
  • City*
  • Country*
  • Phone
  • Email*
  • Contact person*

With the second option for creating an account, we additionally collect the following data:

  • First name
  • Last name
  • Email
  • Password

Fields marked with * are mandatory. Registration cannot be completed without them.

As a protective measure, the data you enter is transmitted – just like visiting the rest of the website – over an encrypted connection. After successful confirmation, your data is stored until you decide to delete individual data or the entire user account. The purpose of the data requested is to create a user account for using extended functions on the website. Registration is voluntary; you can withdraw it at any time or have your user data deleted. The legal basis is your consent in accordance with European data protection requirements under Art. 6(1)(a) GDPR. Where registration is relevant to the conclusion of a contract, the legal basis is the performance of the mutual contract in accordance with European data protection requirements under Art. 6(1)(b) GDPR.

Newsletter

If you are interested in news about our company or our product, you can subscribe to our newsletter. You will then receive an email in which you must click a link to confirm that you wish to receive the newsletter. We then store your email address until you unsubscribe from the newsletter. Every newsletter email contains a link for this purpose. The newsletter is delivered by the specialised service provider Mailchimp (https://mailchimp.com). Further information can be found in the service provider's privacy policy.

As a protective measure, we use the so-called “double opt-in” procedure to ensure that the email address entered actually belongs to you. We have also concluded a data processing agreement with the service provider engaged. In addition, you can unsubscribe from the newsletter at any time and thereby delete your email address from the service provider's database. The purpose of collecting the data is to deliver the newsletter to your personal email address in order to fulfil your wish to receive news about our company or our products. The legal basis is your consent in accordance with European data protection requirements under Art. 6(1)(a) GDPR.

Job applications

If you apply to us online or otherwise respond to one of our job advertisements, we collect and process the personal application data for the purpose of handling the application procedure. Processing is carried out primarily by electronic means. This is particularly the case where application documents are sent to us electronically, for example by email or via a web form on the website. If we conclude an employment contract, the data transmitted will be stored for the purpose of handling the employment relationship in compliance with the statutory provisions. If we do not conclude an employment contract, the application documents will be deleted six months after notification of the rejection decision – this retention period is based on a possible burden of proof in proceedings under the German General Equal Treatment Act (Allgemeines Gleichbehandlungsgesetz, AGG). Where consent has been given, applications may also be retained for longer than six months.

The legal basis for processing is the decision on the establishment and performance of an employment relationship pursuant to Art. 6(1)(b) and Art. 88 GDPR in conjunction with Section 26 of the German Federal Data Protection Act (BDSG).

Cookies

Our website uses so-called cookies in some places. Cookies are small text files that are usually stored in a folder of your browser. Cookies contain information about the current or most recent visit to the website:

  • Name of the website
  • Expiry date of the cookie
  • Any value

If cookies do not contain a specific expiry date, they are only stored temporarily and deleted automatically as soon as you close your browser or restart your device. Cookies with an expiry date remain stored even after you close your browser or restart your device. Such cookies are only removed on the specified date or when you delete them manually.

We use the following three types of cookies on our website:

  • Necessary cookies (we need these, e.g. to display the website correctly for you and to temporarily store certain settings)
  • Functional and performance cookies (these help us, e.g., to evaluate technical data from your visit and thus avoid error messages)
  • Advertising and analytics cookies (these ensure, e.g., that advertising for shoes is displayed to you if you have previously searched for shoes)

You can configure, block and delete cookies in your browser settings. If you delete all cookies from our website, some functions of the website may not be displayed correctly. The German Federal Office for Information Security (BSI) provides helpful information and instructions for common browsers: https://www.bsi-fuer-buerger.de/BSIFB/DE/Empfehlungen/EinrichtungSoftware/EinrichtungBrowser/Sicherheitsmassnahmen/Cookies/cookies_node.html

Conversion tracking and remarketing

To optimise our online offering, to measure the success of our advertising and to display interest-based advertising, we use conversion tracking and remarketing technologies on the basis of the consent you have voluntarily given. In this context, personal data, in particular your IP address and information about your user behaviour (e.g. pages viewed, interactions or orders), is collected and processed by scripts or pixels embedded in our website. The collected data may be linked to a user profile and used across devices. The service providers we use are the following companies:

  • Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland (Meta Pixel for Facebook and Instagram, and Custom Audiences)
  • Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (Google Analytics, Google Tag Manager, Google Ads conversion tracking and remarketing)
  • Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland (Pinterest Tag)
  • TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland (TikTok Pixel)
  • Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (Shopify Analytics)

These providers may link the information transmitted with further data from your respective user profile and also use it for their own purposes, e.g. to build target groups (Custom Audiences) and to display personalised advertising in their respective networks.

The legal basis is your consent in accordance with European data protection requirements under Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future, e.g. via the cookie settings on our website.

Further recipients of data

In line with the descriptions and purposes stated above, we share your data with the following recipients, who are essential to providing our services and communicating with you:

  • Shopify, a service of Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. This is our hosting provider. The servers automatically collect and store information in so-called server log files, which your browser automatically transmits when you visit the website. The data is processed within the European Union. Further information can be found in Shopify's privacy policy.
  • Amplitude, a service of Amplitude, Inc., headquartered at 201 Third Street, Suite 200, San Francisco, CA 94103, USA. Amplitude is used as product analytics software to evaluate usage and interaction behaviour within the app and to further develop the product. The data is processed in the USA. Further information can be found in Amplitude's privacy policy.

We only share data that is necessary to perform the mutual contract or where you have given us your consent, for example in connection with our newsletter or the cookie banner. Where no contract exists yet, we share data in certain cases on the basis of legitimate interests. This is the case, for example, if you merely visit our website or wish to contact us. When you visit our website, it is in our mutual interest to provide access to our offering and to communicate with each other.

We have also concluded data processing agreements with all external recipients in order to meet European legal requirements. Depending on your location, some of the service providers mentioned above – where indicated – will also transfer your data to the United States. An adequacy decision is currently in place between the EU and the USA. It confirms that the USA ensures an adequate level of protection for personal data with regard to organisations certified under the EU-U.S. Data Privacy Framework. Additional data processing agreements, known as standard contractual clauses, are also concluded. In addition, we review every service provider together with our data protection officer and ensure that additional security measures are available, such as strong data encryption.

Child protection notice

Our product is intended for children of pre-school age; the website, however, is intended only for adult parents or legal guardians. Persons under the age of 16 may not submit any personal data to us without the consent of their parents.

Specifics of our mobile app “TukToro”

We, the operators of our mobile app “TukToro”, are responsible for our app, which is made available via app stores (Apple App Store and Google Play Store) (hereinafter the “App”). In this capacity, we are responsible for providing our services and for the processing of data.

Deletion of data and storage period

Unless stated otherwise, we delete your data as soon as it is no longer needed. Your data will also be blocked or deleted when a storage period prescribed by law expires, unless further storage of the data is necessary for the conclusion or performance of a contract. Certain data may have to be retained for longer for legal reasons. You can, of course, request information about the stored data at any time. Within the App, you can delete all data stored so far relating to your orders and reset your authentication at any time.

How is your personal data protected?

We take all reasonable and appropriate measures to protect the personal information we store against misuse, loss or unauthorised access. To this end, we have implemented a range of technical and organisational measures. These include measures for dealing with any suspected data breaches.

To protect your data, we have taken the following technical and organisational measures, among others:

  • End-to-end TLS (TLS 1.3) between the App and the backend
  • AES-256 encryption of data at rest (Firebase, Cloud Storage)
  • Two-factor authentication and role-based authorisation concept
  • Regular penetration tests and vulnerability scans
  • Redundant backups, disaster recovery plans
  • Logging and monitoring (SIEM) with 30-day retention

If you suspect that your personal information has been misused, lost or accessed without authorisation, please let us know as soon as possible using the contact details above.

Data collection in our App

When you use our App, we collect and store certain (technically necessary) data about you in order to provide services and to improve them overall:

  • Device identifier and user-related device metrics
  • Language settings (e.g. system language German)
  • Mobile data for determining location
  • Date and time of use (e.g. 11:45 on 25 May 2018)
  • Operating system (iOS, Android)
  • Hardware

To protect your privacy, we delete or anonymise identifiers in our database and most technical data after your use. The purpose of temporarily storing this data is to establish a connection to our servers and to provide the App. The legal basis is the contract with you pursuant to Art. 6(1)(b) GDPR and legitimate interest in accordance with European data protection requirements under Art. 6(1)(f) GDPR. In addition, we apply the security measures described above to protect your data.

Use of the App and sign-in

In addition, certain data is required to use our App. Besides signing in with your email address, you can sign in directly with your existing Google or Apple account. This involves the following data:

  • Email address
  • SSO token
  • User ID
  • Password

To protect your privacy, we delete or anonymise identifiers in our database and most technical data after your use. Usage data is evaluated exclusively on a statistical basis and not in a way that relates to individuals. The purpose of processing this data is to enable use of the App and its services and functions. The legal basis is the usage agreement with you pursuant to Art. 6(1)(b) GDPR and legitimate interest pursuant to Art. 6(1)(f) GDPR. You can object at any time to processing based on legitimate interests and explain why your interest outweighs ours. Unfortunately, it will then no longer be possible to use our App. In addition, we apply the security measures described above to protect your data.

User profiles

Several individual user profiles for children can be created and managed in the TukToro App. The profiles make it possible to set up the App individually for different users and to keep personal settings and learning progress separate from each other.

When a child profile is created, a made-up name is assigned automatically, which can be changed at any time. In addition, a TukToro colour and a sticker can be assigned to each profile.

The following information is transmitted to and stored on our servers for each child profile:

  • Profile name (made-up name)
  • Assigned TukToro colour
  • Selected sticker
  • Selected language
  • Information about games downloaded and displayed within the App (IDs of the installed games, visibility settings of the installed games)

This data is processed in order to provide and manage the child profiles and to configure the App individually. The data is transmitted to our servers in order to synchronise it across multiple devices.

The legal basis for this processing is the performance of the usage agreement concluded with you pursuant to Art. 6(1)(b) GDPR.

Profile data is stored until the respective child profile or the associated adult user account is deleted. Uninstalling the App does not automatically delete the data stored on our servers.

The learning progress data and learning results assigned to the respective child profiles are not transmitted to our servers or to any other external systems. They are stored and evaluated exclusively locally on the device used, as described in the following section “Learning progress analysis”.

Learning progress analysis

Our TukToro App offers an optional function for recording, evaluating and displaying individual learning progress. This involves processing, in particular, information about which learning games were used, which tasks were completed and which learning results were achieved.

The recording, storage and evaluation of this learning progress data take place exclusively locally on the device used. We do not transmit this data to our servers or to any other external systems. We have no access to this data and can neither view it nor evaluate it for our own purposes.

Learning progress analysis is enabled by default. The local recording, storage and evaluation of learning progress data is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in displaying individual learning progress within the App and making it comprehensible. In balancing the interests, particular account was taken of the fact that processing takes place exclusively locally, that we have no access to the data and that learning progress analysis can be disabled at any time.

You can disable recording at any time in the adult area. Once it is disabled, no new learning progress data is recorded or evaluated. Learning progress data already stored initially remains on the device so that it is still available if the function is re-enabled later.

You can object to the processing at any time by disabling learning progress analysis. Irrespective of this, all locally stored learning progress data can be permanently deleted in the adult area of the App. Deletion takes place on the device used and cannot be undone.

The TukToro App can also be used without learning progress analysis enabled.

App permissions

When you download our App via an app store, you transmit certain information to that platform, in particular your account details, e.g. name, device identifier and email address. We have no influence on this data collection and are not responsible for it.

Some functions of our App require access to certain functions and services on your device. Depending on the mobile operating system you use, you may need to accept certain app permissions.

Notifications

Push notifications: If you select OK in the “Allow push notifications” pop-up window, you allow the App to send you notifications.

To protect your privacy, all app permissions are optional, with the exception of the technical permissions required to run the App. You can decline at any time (by tapping “No” or “Don't accept”). You can also revoke permissions later by changing the corresponding settings on your device. The purpose of requesting these permissions is to provide you with our service and app-specific functions. One of the functions and services of our App is to send you notifications about certain events. The legal basis is your consent in accordance with European data protection regulations under Art. 6(1)(a) GDPR.

Newsletter

If you are interested in news about our company or our product, you can subscribe to our newsletter in the App. We then store your email address until you unsubscribe from the newsletter. Every newsletter email contains a link for this purpose. The newsletter is delivered by the specialised service provider Mailchimp (https://mailchimp.com). Further information can be found in the service provider's privacy policy.

Recipients of data

In line with the descriptions and purposes stated above, we share your data with the following recipients, who are essential to providing our services and communicating with you:

  • Google Firebase, a service of Google Ireland Ltd., headquartered at Gordon House, Barrow Street, Dublin 4, Ireland. Firebase is used to provide various backend services, in particular Cloud Firestore, Realtime Database and Cloud Storage. These services are used for real-time data processing, data storage and synchronisation of content within the App. In this context, usage data such as IP addresses, device information and app interactions is processed. IP addresses are anonymised where technically possible. Data is generally processed within the European Union. Further information can be found in Google's privacy policy.
  • Firebase Cloud Messaging and Apple Push Notification Service: Notifications are sent via Firebase Cloud Messaging, a service of Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, and via the Apple Push Notification Service of Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA. These services enable notifications to be sent to devices on the basis of technical identifiers (e.g. device tokens). No personal content is transmitted. Processing by Google generally takes place within the EU, processing by Apple in the USA. Further information can be found in the respective privacy policies of Google and Apple.
  • Amplitude, a service of Amplitude Inc., headquartered at 201 Third Street, Suite 200, San Francisco, CA 94103, USA. This is product analytics software for websites and apps. It is used to gain insights into the use of websites and platforms. Processing company: Amplitude, Inc., 501 2nd Street, Suite 100, San Francisco, CA 94107, United States of America. Further information can be found in Amplitude's privacy policy.
  • Google Analytics for Firebase, a service of Google Ireland Ltd., headquartered at Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics for Firebase is used to analyse user behaviour within the App (including IP anonymisation). This records, among other things, app launches, click paths, device models and approximate location data. Data is generally processed within the European Union. Further information can be found in Google's privacy policy.
  • reCAPTCHA, a service of Google Ireland Ltd., headquartered at Gordon House, Barrow Street, Dublin 4, Ireland. This is a service that checks whether data is entered by a human or by an automated program. Further information can be found in Google's privacy policy.
  • Usercentrics – User Consent Management Platform, a service of Usercentrics GmbH, Sendlinger Str. 7, 80331 Munich, Germany. This is a consent management service. On websites and in apps, Usercentrics GmbH acts as a processor to ensure consent management. Further information can be found in Usercentrics' privacy policy.
  • Firebase Crashlytics, a service of Google Ireland Ltd., based at Gordon House, Barrow Street, Dublin 4, Ireland. Crashlytics is used to analyse app crashes and performance problems. In the event of an error, anonymised diagnostic data such as timestamps, device information, operating system versions and technical details of the crash is transmitted to Google in order to improve the stability and reliability of the App. Data is generally processed within the European Union. Further information can be found in Google's privacy policy.
  • Google Sign-In, a service of Google Ireland Ltd., based at Gordon House, Barrow Street, Dublin 4, Ireland. This service is used to enable users to sign in with their Google account. To sign in or register, the user is redirected to Google's page and can sign in there with their account details. This links the user's Google profile or Google email address with the service. Further information can be found in Google's privacy policy.
  • Xentral Helpdesk Cloud, a service of Xentral ERP Software GmbH, based at Fuggerstraße 11, 86150 Augsburg, Germany. The helpdesk service is used to handle and document support requests. In this context, personal data such as name, email address, communication content and technical metadata may be processed. Data is processed exclusively within the European Union. Further information can be found in Xentral's privacy policy.
  • Google Workspace, a service of Google Ireland Ltd., based at Gordon House, Barrow Street, Dublin 4, Ireland. Google Workspace is used for internal communication, document management and email correspondence. In this context, personal data such as email addresses, communication content and file content is processed. Data is generally processed within the European Union. Further information can be found in Google's privacy policy.

Personal data of children

We are aware of the importance of children's safety and data protection on the internet. Our services are also aimed at children under the age of 16. In accordance with Art. 8 GDPR, we only process personal data of children under the age of 16 if and to the extent that the consent of the parents or other persons with parental responsibility has been obtained.

Last updated: October 2026