Privacy policy

This is a translation of the German Datenschutzerklärung, provided for convenience. In case of any discrepancy, the German version is the binding one.

This website processes as little data as is technically possible. It sets no cookies, uses no analytics or tracking services and loads no content from third-party servers. What does arise is set out here in full.

This policy covers karuki.de. It does not cover our apps, nor the sites of the group’s other brands — staubenthal.de, darue.de and klarwetter.com — which carry their own.

1. Controller

The controller for the processing of personal data within the meaning of Art. 4(7) GDPR is:

No data protection officer has been appointed; the conditions of Art. 37 GDPR in conjunction with § 38 BDSG (German Federal Data Protection Act) are not met.

2. Hosting and server log files

The website runs on a virtual server operated by the controller itself. The underlying infrastructure is provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, in the Azure region Germany West Central (data centre in Germany). A data processing agreement is in place with Microsoft; the processing takes place within the European Union.

On every request the web server writes technically necessary access data to log files:

• IP address of the requesting device
• date and time of the request
• name and path of the file retrieved
• amount of data transferred and HTTP status code
• browser and operating system identifier transmitted
• the page visited before, if the browser transmits it

Purpose: delivering the page, operational security, detecting and tracing attacks and technical faults.
Legal basis: Art. 6(1)(f) GDPR. The legitimate interest lies in the secure and stable operation of the website.
Retention: 14 days, then automatic deletion.

The log files are not combined with other data sources and are not used to analyse user behaviour.

3. Encryption

The website is available over HTTPS only; requests over HTTP are redirected to HTTPS. The connection is thereby protected against being read or altered in transit.

4. No cookies, no tracking

This website sets no cookies and uses no local storage in the browser. No analytics, statistics, advertising or social media services are embedded. No profiling and no automated decision-making within the meaning of Art. 22 GDPR takes place.

5. No third-party content

All parts of the page — stylesheet, graphics and fonts — are delivered from our own server. In particular, no fonts are loaded from external providers. Visiting this website therefore creates no connection to third-party servers, and no IP address is transmitted to third parties.

6. Contact by e-mail

The website contains no contact form. Anyone writing by e-mail thereby transmits their sender address and the content of the message.

Purpose: handling the enquiry and any follow-up communication.
Legal basis: Art. 6(1)(b) GDPR where the enquiry concerns a contract, otherwise Art. 6(1)(f) GDPR with the legitimate interest in replying.
Retention: until the matter is closed and no statutory retention periods apply. Commercial and tax law periods may require longer retention.

The e-mail service for the addresses of this domain is operated as part of Google Workspace by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as a processor, on the basis of a data processing agreement under Art. 28 GDPR.

Processing outside the European Union — in particular by Google LLC in the United States — cannot be ruled out in this case. Google participates in the EU-US Data Privacy Framework; standard contractual clauses apply in addition.

A note for honesty’s sake: unencrypted e-mail is not a secure channel. For confidential content another route should be agreed.

7. Disclosure of data

Personal data is not disclosed to third parties, except to the processors named under numbers 2 and 6 within the scope of their technical service, or where a legal obligation exists. No data is sold or made available for advertising purposes.

8. Your rights

You have the following rights against the controller with regard to personal data concerning you:

• access to the data processed (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)

A message to the contact address above is enough to exercise them. Exercising them is free of charge.

9. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority, in particular the authority of your place of residence or of the controller’s registered office. The authority responsible for the controller is:

10. Obligation to provide data

Transmitting the access data named under number 2 is technically necessary in order to deliver the page; without it a request is not possible. Beyond that there is no obligation to provide personal data. Getting in touch is voluntary.

11. Changes to this policy

This policy is adjusted when the processing changes — because a service is added or dropped, for instance. The version published here applies in each case.

Last updated: 20 September 2026