Privacy policy
This English version is a convenience translation. Only the German version is legally binding.
This policy applies to karena.app: the website, registration and the operation of the platform where we are the controller ourselves. It does not apply to the processing of member, athlete and parent data by schools and federations that use Karena. The respective organization is responsible for that (see section 3).
1. Controller
Koordinauten GmbH
Kieselbronner Str. 42 / 3
75177 Pforzheim
Germany
Managing directors: Mike Nagel, Sebastian Witt
Email: datenschutz@koordinauten.de
Data protection officer: [Name / firm, email]
2. Overview of processing
| Activity | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Visiting the website | IP address, timestamp, URL, user agent, referrer | Delivery, security, error analysis | Art. 6 (1) (f) | Server logs 7 days |
| Waiting list / contact | Email, organization, type of organization; for contact by email also name and message | Reply, onboarding | Art. 6 (1) (b), (f) | Until resolved, max. 12 months |
| Registration & account | Email, name, password (hashed), organization, role | Performance of contract, access | Art. 6 (1) (b) | Term of contract + 30 days |
| Session / login | Session cookie, CSRF token, active organization | Technically necessary | § 25 (2) no. 2 TDDDG; Art. 6 (1) (b) | Session |
| Sending email | Email address, subject, delivery status | Confirmation, password reset, invitations, notifications | Art. 6 (1) (b) | Sending logs 30 days at the provider |
| Contract billing | Billing address, the organization's payment details, plan | Billing of the Karena subscription | Art. 6 (1) (b), (c) | 10 years (§ 147 AO, § 257 HGB) |
| Support | Contact details, content of the request, screenshots if any | Troubleshooting | Art. 6 (1) (b), (f) | 12 months after closure |
| Support access (impersonation) | Support staff member, affected account, time period | Traceable error analysis and support | Art. 6 (1) (b), (f) (audit log) | Audit log 12 months |
3. Distinction: Karena as processor
When a school, a federation or a franchise company uses Karena to manage members, athletes, guardians, training, gradings, competitions or fees, that organization is the controller within the meaning of Art. 4 (7) GDPR. We process this data solely on behalf of and on the instructions of the organization, based on a data processing agreement (Art. 28 GDPR).
Data subjects should direct requests for access, erasure and other requests concerning this data to the respective organization. Its privacy notice is available on the organization's website. We support the organization in answering and forward requests that reach us directly.
White-label instances: If Karena is operated under an organization's own domain, the imprint and privacy notice of that organization apply on that domain.
4. Hosting and infrastructure
The platform runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Server location: Falkenstein, Germany. Files (images, PDF documents, exports) are stored in Hetzner Object Storage (S3-compatible), also in Falkenstein, Germany. A data processing agreement is in place with Hetzner; Hetzner is ISO 27001 certified.
Hosting involves no transfer to third countries outside the EU/EEA.
5. Cookies and local storage
We use only technically necessary cookies:
| Cookie | Purpose | Duration |
|---|---|---|
_kao_key |
Session, login, active organization | Session; 60 days with "Stay signed in" |
| CSRF token | Protection against cross-site request forgery | Session |
karena_locale |
Selected website language | 1 year |
We use no analytics, tracking or advertising cookies. A cookie banner is therefore not required (§ 25 (2) no. 2 TDDDG). The website embeds no external analytics, font or embedding services.
6. Registration, account and invitations
Using the platform requires a user account. At registration we collect email address, first and last name and a password, which is stored only as a hash (bcrypt). The email address is verified by confirmation link (double opt-in).
Accounts can also be created through an invitation from an organization (email invitation or join code). In that case the inviting organization has passed your email address to us; the legal basis is the contractual or membership relationship between you and the organization.
We store settings linked to the account (language, last active organization, notifications) to provide the service.
7. Sending email (Brevo)
For transactional emails (registration confirmation, password reset, invitations, notifications) we use Brevo (Sendinblue SAS, 7 rue de Madrid, 75008 Paris, France). Brevo processes email address, subject, content and delivery status on our behalf under a data processing agreement. Place of processing: EU.
We do not send newsletters or advertising emails.
8. Contact and waiting list
When you send a request through the contact form or the waiting list on karena.app, we store the details provided in order to handle it. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures) or (f) (legitimate interest in replying).
9. Interfaces and third-party clients (API / MCP)
Organizations can connect Karena to their own tools through interfaces (API, Model Context Protocol), including AI assistants. The organization activates such a connection and is responsible for it; the data is then transferred to the provider the organization has chosen. We ourselves do not transfer customer data to AI providers. Access through interfaces is subject to the same permissions as in the application and is logged.
10. Security
We take technical and organizational measures under Art. 32 GDPR, including: TLS encryption of all connections, role-based access control with separation by organization, database-level encryption of particularly sensitive data (e.g. bank details), private storage of documents with time-limited access links, regular backups and logging of administrative access. Details are described in the data processing agreement (annex on technical and organizational measures).
11. Recipients and transfers
| Recipient | Role | Location | Basis |
|---|---|---|---|
| Hetzner Online GmbH | Hosting, object storage | Germany | DPA, Art. 28 |
| Brevo (Sendinblue SAS) | Sending email | France | DPA, Art. 28 |
There is no transfer to third countries outside the EU/EEA.
12. Retention
We store personal data only as long as necessary for the respective purpose or as required by statutory retention obligations (in particular § 147 AO, § 257 HGB for invoice data). User accounts are deleted 30 days after the contract ends or after a deletion request; accounts that exist only through an organization are subject to that organization's deletion policy. Details: see the table in section 2.
13. Your rights
Regarding data about you for which we are the controller, you have the following rights towards us:
- Access (Art. 15)
- Rectification (Art. 16)
- Erasure (Art. 17)
- Restriction of processing (Art. 18)
- Data portability (Art. 20)
- Objection to processing based on Art. 6 (1) (f) (Art. 21)
- Withdrawal of consent with effect for the future (Art. 7 (3))
Please send requests to datenschutz@koordinauten.de. For security, we may ask you to verify your identity.
Right to lodge a complaint: You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de.
14. No automated decision-making
We do not make decisions based solely on automated processing that have legal effect within the meaning of Art. 22 GDPR.
15. Changes
We update this policy when our processing or the legal situation changes. The current version is available at karena.app/datenschutz.
Last updated: 30 September 2026