Privacy notice

Patrick Walter, Westerbachstraße 287, 65936 Frankfurt am Main, Germany, is responsible for this processing as the controller. He operates Nutchi.

Send privacy enquiries and requests for access or erasure to contact@nutchi.de or the postal address above. Please do not initially attach identity documents or other sensitive records. If further information is needed to identify your records or verify your identity, we will discuss this with you.

• Privacy contact: contact@nutchi.de

To deliver pages you request, the server infrastructure processes your IP address, requested address and technical connection data. Error and security logs may contain timestamps, request or error details and technical device information. Short-term, IP-related request counters limit activities such as sign-in attempts and file uploads.

This supports availability, troubleshooting and protection against abuse. The basis is Article 6(1)(f) GDPR; our legitimate interest is a secure, functioning service. Where this is necessary for account features you request, Article 6(1)(b) GDPR applies.

You sign in through an email link. We process your email address, a time-limited sign-in token, verification time and account identifier. A protected session keeps you signed in. This does not create a separate Nutchi password.

Your profile and case may contain contact details, date of birth, nationality, residence, language skills, education, work experience and your intended route to Germany. Tasks, deadlines, progress, feedback and case notes are entered by you or the team assisting you. Please provide only information needed for your request.

You may optionally record your current situation and a next goal, such as an interest in training during an existing au pair stay. These details support your conversation with our team; they do not create a new placement assignment, share documents or start a subscription.

The purpose is to provide the account you request and handle your enquiry or agreed support. The basis is Article 6(1)(b) GDPR. You cannot sign in without an email address. We cannot process a particular step without the information necessary for it. Optional additional information is not required simply to visit the website.

Acceptance of the terms of use is recorded with your account identifier, terms version and timestamp. This supports performance of the contract and evidence of the agreed terms (Article 6(1)(b) and (f) GDPR). This privacy notice provides information; acknowledging it is not blanket consent.

When you upload a document, we store the file, filename, type, size, versions and its link to your account or case. Review status, feedback and document requests are also recorded. Files are not publicly accessible; access requires an authorised sign-in. Authorised team members may view them to assist you. Article 6(1)(b) GDPR is the basis for ordinary documents necessary for that support.

Do not upload health certificates, diagnoses, criminal record certificates, or information about religion, political opinions, sex life or other unnecessary sensitive circumstances. The dedicated upload types for health and criminal record certificates are blocked. This is not a complete content inspection: such information may occur in other document types. Redact unnecessary information and other people's data before uploading.

Special categories of personal data are additionally subject to Article 9 GDPR; information about offences and convictions is subject to Article 10 GDPR. General account acceptance, or this notice, does not provide a sufficient legal basis. If you have already submitted such data, contact us to review how it should be handled without sending it again.

The technical document helper evaluates filenames, file types and sizes. It does not read document contents through optical character recognition or send them to an external AI provider for analysis. Its suggestions do not replace a review of the contents or an official assessment.

For contact enquiries, we process your name, email address, message and additional details you provide, such as a telephone number, country of residence or intended route. The contact form also records the transmitted referrer address and browser identifier for technical context. Support messages and replies are linked to your account and conversation.

The host family and training employer forms collect a contact person, email address, optional telephone number, location and preferred start. Training employers also provide their company, training occupation and requirements; families may provide the number of children, broad age groups and expectations for the stay. We do not request children's names, exact birth dates, health details or applicant documents in these forms. The details are stored as an enquiry for authorised team members to discuss possible cooperation; they do not create a public family or applicant profile.

Communications concerning a contract or steps you request before a contract are based on Article 6(1)(b) GDPR. Other enquiries are based on Article 6(1)(f) GDPR; our interest is to respond appropriately and keep a record of the communication.

Sign-in links and service messages are sent through IONOS. Email addresses, subjects, message contents and delivery information are processed. Messages may contain task titles, document status and the team's feedback. Our server's connection to IONOS uses transport encryption. Ordinary email is not an end-to-end encrypted document store; use the protected customer area for necessary documents. The daily automated reminder service currently creates account notifications only, not reminder emails.

Signing in is not consent to newsletters or advertising. Online payments through Stripe are currently disabled, so payment data is not currently sent through that payment service.

Authorised team members work on accounts, cases, documents and support requests. Changes are logged with the person or technical process responsible, time, affected record and change details. Certain account and document actions may also include an IP address. This supports security, investigation of errors and traceable case handling (Article 6(1)(b) and (f) GDPR).

For cooperation with organisations, we also record business contact details, responsibilities and information about jobs or placements. Information is provided by the contact person or their organisation, or entered by the Nutchi team. The basis is Article 6(1)(f) GDPR for organising business cooperation, or Article 6(1)(b) GDPR where the individual is a contracting party. Where contact details are not collected directly, additional information about their specific source is required.

Assigning a case to a partner or placement is initially an internal feature. It does not automatically send documents to employers, schools, authorities or partners. Any later specific disclosure requires a defined purpose and appropriate legal basis; separate information must be provided beforehand.

Actual employment or vocational training placement is distinct from current account use and preparation. Before a specific placement process begins, separate privacy information and the special requirements of section 298 of German Social Code Book III must be addressed, including the required consent in the individual case and rules for returning and retaining documents. Account terms do not replace these requirements.

Rules may prioritise enquiries using particular keywords and display open tasks or deadlines. They do not independently decide about placement, admission or residence rights. We do not make decisions based solely on automated processing that have legal or similarly significant effects under Article 22 GDPR.

The website, database and private document storage run on a server supplied by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. The actual server is in Nuremberg, Germany. We operate the Supabase database and storage software ourselves there; we do not use a managed Supabase cloud project for these functions.

We use IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, for email services. Your own email provider also processes messages delivered to your mailbox under its own terms.

Database and file backups allow recovery after data loss. In addition to access-restricted server backups, extra backup packages are encrypted before transfer to a Windows computer controlled by the operator. They also contain earlier records and document versions. The basis is Article 6(1)(f) GDPR; our interest is the recoverability and integrity of the data entrusted to us.

Recipients are authorised team members and the technical providers named above, to the extent needed. Relevant authorities may receive data where a specific legal obligation requires it (Article 6(1)(c) GDPR). The application's server location does not establish every location of email recipients or future partners. This notice does not grant blanket consent to transfers outside the European Economic Area. For a planned transfer, recipients, countries and requirements under Articles 44 onwards GDPR must be assessed and communicated separately.

• netcup privacy information
• IONOS privacy information

The requested sign-in uses cookies for the session, protection of sign-in forms and returning to the intended page. Your selected language is stored under nutchi.locale in local browser storage. Your privacy choice is stored under nutchi.privacy.v3 with version and time information so that it is remembered on later visits. After withdrawal, Matomo may also store the necessary mtm_consent_removed cookie for up to 180 days to respect the refusal.

Where storage or access is strictly necessary for the function you expressly request, section 25(2), point 2, of the German TDDDG applies. Subsequent processing of personal data is based on Article 6(1)(b) GDPR for account functions and Article 6(1)(f) GDPR for secure management of your settings. You can use your account without consenting to optional statistics.

A sign-in session is limited to 30 days and may be renewed during further use. A sign-in link is valid for 30 minutes and intended for a single use. A privacy choice is valid for no more than 180 days; you are asked again after expiry or a change to the statistics configuration. Expired choices are removed on an open page when they expire or on your next visit. Your language preference remains until changed or deleted in your browser. Clearing browser data may require you to sign in and select your preferences again.

• Section 25 TDDDG (German official text)

With your consent, we use Matomo to measure visits to public Nutchi pages. This helps us understand which pathways and guides are used and improve the service. Measurement starts only after your choice; it remains off without consent. The bases are Article 6(1)(a) GDPR and section 25(1) of the German TDDDG.

Matomo runs on our server at netcup in Nuremberg at analytics.pandorex.info. Nutchi is measured as a separate website. Data includes public pages viewed, timestamps, visits and technical browser or device information. IP addresses are shortened during processing; location estimates use only the shortened address. Private account and administration pages, documents, form entries, search text, URL parameters and referrer addresses are excluded from these statistics. Nutchi does not use heatmaps or session recordings.

After consent, Matomo uses first-party cookies on the Nutchi domain: _pk_id.* for pseudonymous recognition, valid for no more than 180 days, and _pk_ses.* to group pageviews within a visit, valid for 30 minutes. These identifiers are not linked to your account email address or Nutchi user identifier. The statistics should therefore not be regarded as fully anonymous.

Individual visit records are removed after 90 days and statistical reports after 24 months through the regular deletion process. Routine Matomo backups are retained for 14 days. These periods apply to statistics; account and document retention is described in the next section.

You can decline analytics or withdraw consent at any time under Privacy settings. This stops further collection and removes Matomo tracking cookies. Processing carried out before withdrawal remains lawful. Browser privacy signals (Do Not Track and Global Privacy Control) are respected. Old choices or choices saved for another configuration do not enable Matomo.

Retention depends on whether data is still needed for its particular purpose. Longer retention may be justified by an applicable legal obligation or the handling and enforcement of specific claims. The mere possibility of future use is not a separate reason for retention.

Account, case and document data is currently not erased automatically after a fixed number of days. Erasure requests are reviewed and handled by the operator. An expired session, completed step or new document version does not automatically erase account data or earlier files.

• Account, profile and case: relevant criteria are the period during which you want to use the account and support, completion of open requests, and evidence still needed. If you request account erasure, we assess which data can be erased and which must be retained for a specific reason.
• Documents, versions, tasks and support: relevant criteria are their need for the case, traceability of open reviews and legitimate evidential purposes. A new upload does not overwrite earlier versions.
• Contact enquiries without subsequent cooperation: relevant criteria are completion of the reply and any outstanding questions or claims.
• Security and activity records: relevant criteria are investigation of specific errors or incidents and necessary evidence. Technical container logs rotate at size limits, not after a fixed period in days. Database activity records currently have no automatic age-based erasure rule.
• Backups of account, case and document data: older packages currently are not removed under an automatic age-based schedule. Continued retention must be reviewed against recovery needs and required evidence. Erasure in the live system does not simultaneously remove older backups. An erasure request must therefore also address those copies and any later restoration.
• Sign-in links and browser preferences: the periods above describe technical validity. They are not general erasure periods for all account data or server-side records.

Subject to the legal conditions, you can exercise your rights by contacting Patrick Walter at contact@nutchi.de. In particular, you have these rights:

• Access to your data and a copy (Article 15 GDPR), rectification of inaccurate information (Article 16), erasure (Article 17) and restriction of processing (Article 18).
• Data portability for data you have provided where automated processing is based on consent or a contract (Article 20 GDPR).
• Objection to processing under Article 6(1)(f) GDPR on grounds relating to your particular situation (Article 21 GDPR). You may object to direct marketing at any time without giving such grounds.
• Withdrawal of consent you have actually given, with effect for the future (Article 7(3) GDPR). Withdrawal does not affect the lawfulness of processing before it or automatically end processing with a different legal basis.
• A complaint to a data protection authority (Article 77 GDPR), particularly in the place of your habitual residence, work or the alleged infringement. For the operator in Frankfurt am Main, you can contact the Hessian Commissioner for Data Protection and Freedom of Information.

• Email a privacy request
• Complaint to the Hessian data protection authority

This notice describes the Nutchi functions above. Before introducing new processing, such as a payment provider, specific external placements or additional statistics, it must be updated. Processing based on consent may also require a new, separate choice.

The legal text is available in German and English. If you select Kinyarwanda, the English text is shown with a notice. A legally reviewed Kinyarwanda translation is not available.

• General Data Protection Regulation – official text