Privacy Notice

Last updated: 26 October 2026

1. About this privacy notice

This privacy notice explains how EduCocreation GmbH ("we", "us", "our") processes personal data when you visit our company website at educocreation.de (the Website).

The Website is a static information site. It has no user accounts, no forms, no analytics and no cookies, and it loads no fonts or scripts from third parties. The only personal data processed in connection with the Website is the server log data described in section 4 and the data you send us if you choose to contact us by email (section 5).

This notice applies to everyone who visits the Website. It does not cover our product Nuri Tales (the mobile app, the web app and the website at www.nuri-tales.com), which has its own privacy notice at https://www.nuri-tales.com/privacy. It also does not cover third-party websites you may reach via links from the Website; please consult their own privacy notices.

If you have any questions about this notice or about how we handle your personal data, please contact us at privacy@educocreation.com.

2. Controller and contact

The controller for the processing of personal data through the Website within the meaning of Article 4(7) of the EU General Data Protection Regulation (GDPR) is:

2.1 Data Protection Officer

EduCocreation GmbH has not appointed a Data Protection Officer because we are not required to do so under Article 37 GDPR or Section 38 BDSG. For all data-protection enquiries please write to privacy@educocreation.com or to the postal address above.

3. General principles of data processing

We process personal data only on a lawful basis. Depending on the activity, the legal basis is one of the following:

• Article 6(1)(b) GDPR — performance of a contract, or steps taken at your request prior to entering into a contract, where you contact us about our products or services.
• Article 6(1)(c) GDPR — compliance with a legal obligation, for example commercial-law and tax-law retention of business correspondence.
• Article 6(1)(f) GDPR — legitimate interests, for example operating the Website securely, preventing fraud and abuse, or diagnosing technical errors. Where we rely on this basis, we have weighed our interests against your fundamental rights and freedoms.

We collect personal data only to the extent necessary for the purpose described in each of the sections that follow. We do not sell personal data, and we do not use personal data for any purpose other than the one for which it was collected, unless you have separately consented or we are required to do so by law.

4. When you visit our website

4.1 Hosting

The Website is hosted by Elestio Limited (66 Fitzwilliam Square, Dublin 2, Ireland) on EU infrastructure (Hetzner Online GmbH, Falkenstein, Germany). Elestio acts as our processor under Article 28 GDPR.

4.2 Server log data

When you load any page on the Website, the following data is automatically transmitted by your browser to our hosting provider:

• IP address,
• date and time of the request,
• HTTP method, URL and referrer,
• response status,
• browser type and version, operating system and language.

This data is processed on the basis of Article 6(1)(f) GDPR for our legitimate interest in operating the Website securely, defending against attacks and diagnosing errors. The IP address is used only for the duration of the request, in particular for routing responses and for rate-limiting; we do not build profiles from it. Server log data is deleted after 30 days.

4.3 Cookies and similar technologies

A cookie is a small text file that a website stores on your device. The Website sets no cookies of any kind — no strictly necessary cookies, and no analytics, advertising or tracking cookies. It also stores no other information on your device and reads none from it. No consent is therefore required under § 25 TDDDG, and there is no cookie banner.

4.4 No analytics, no third-party content

We do not measure how the Website is used. We do not use Google Analytics, PostHog, Meta Pixel, advertising trackers, or any cross-site tracking technology. All fonts, stylesheets, scripts and images are served from our own hosting; nothing is loaded from third-party servers when you view the Website, so no third party learns about your visit.

5. When you contact us

The Website contains no contact form. If you contact us at hello@educocreation.com or privacy@educocreation.com, we receive your email address, your name if it is included in the message, and the contents of your message. We use this information to respond to you and to keep a record of the request.

Our email is operated with Google Workspace, provided by Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland), which acts as our processor under Article 28 GDPR.

• Purpose: to handle enquiries and complaints.
• Legal basis: Article 6(1)(b) GDPR where the request relates to a contract or to steps taken at your request prior to entering into a contract; Article 6(1)(f) GDPR where it does not.

We retain correspondence for 24 months after the last reply, and longer if required for legal obligations or to defend legal claims.

6. Required provision of personal data

You can visit the Website without providing any personal data beyond the server log data that your browser transmits automatically (section 4.2). If you contact us by email, we need your email address in order to reply; all other information you include is provided at your discretion.

7. Categories of recipients

Within EduCocreation GmbH, only those staff members whose role requires it have access to your personal data, and only to the extent necessary.

In addition, the following categories of external recipients receive personal data on our behalf as processors under Article 28 GDPR:

• Hosting provider — Elestio (website hosting), on EU infrastructure.
• Email provider — Google Workspace (Google Ireland Ltd.), for the email correspondence described in section 5.
• Public authorities, courts and legal advisors — where we are obliged or permitted by law to disclose personal data.

We have signed a data processing agreement under Article 28 GDPR with each of our processors.

8. Transfer to third countries

The Website is hosted in the European Union. Our email provider, Google Ireland Ltd., is established in the European Union; where personal data is nevertheless transferred to a country outside the European Economic Area — in particular to the United States, where Google LLC has its headquarters — the transfer is safeguarded by the Standard Contractual Clauses adopted by the European Commission under Article 46(2)(c) GDPR.

9. Security

We use technical and organisational measures appropriate to the risk to protect your personal data against unauthorised access, alteration, loss and destruction. These measures include:

• TLS encryption of all traffic between your device and our servers,
• access controls and the principle of least privilege for our staff and our processors,
• regular security reviews of our code, dependencies and infrastructure,
• documented incident response procedures.

We continuously review and improve our security measures in line with the state of the art.

10. Storage period

We keep personal data only for as long as is necessary for the purposes for which it was collected, or as long as we are required to keep it by law.

• Server access logs — 30 days.
• Email correspondence — 24 months after the last reply.
• Business correspondence subject to commercial-law or tax-law retention duties — 6 or 10 years (§ 257 HGB, § 147 AO).

11. Your rights

You have the following rights with regard to the personal data we hold about you:

• Right of access (Article 15 GDPR) — to obtain confirmation of whether we process your personal data, and if so, to receive a copy of that data and information about how it is processed.
• Right to rectification (Article 16 GDPR) — to have inaccurate personal data corrected and incomplete data completed.
• Right to erasure (Article 17 GDPR) — to have your personal data deleted, in particular when it is no longer necessary for the purposes for which it was collected.
• Right to restriction of processing (Article 18 GDPR) — to require us to limit processing in defined circumstances.
• Right to data portability (Article 20 GDPR) — to receive your personal data in a structured, commonly used and machine-readable format, or to have it transmitted to another controller.
• Right to object (Article 21 GDPR) — to object on grounds relating to your particular situation to processing carried out on the basis of Article 6(1)(f) GDPR.
• Right to withdraw consent (Article 7(3) GDPR) — to withdraw consent at any time where processing is based on Article 6(1)(a) GDPR. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at privacy@educocreation.com. We will respond to your request without undue delay and at the latest within one month.

You also have the right to lodge a complaint with a supervisory authority (Article 77 GDPR). The supervisory authority competent for EduCocreation GmbH is:

You may also lodge a complaint with the supervisory authority of your habitual residence or place of work.

12. Automated decision-making, including profiling

We do not use automated decision-making that produces legal effects concerning you or that significantly affects you within the meaning of Article 22(1) GDPR in connection with the Website, and we do not carry out profiling within the meaning of Article 4(4) GDPR.

13. Changes to this notice

We may update this privacy notice from time to time, for example to reflect changes to the Website, to our processors or to applicable law. The version date at the top of this notice indicates when it was last revised.