1. Controller
The controller for PrimusKids is insightformer UG (haftungsbeschränkt), Liebigstraße 36, 01187 Dresden, Deutschland, represented by managing director Adrian Zimmermann.
Privacy requests may be sent to info@insightformer.com or made by telephone at +49 15678 363731.
↑ Back to contents2. DigitalOcean hosting
For production, the website, application database and protected product access will be hosted by DigitalOcean, LLC. Frankfurt am Main, Germany, is the selected data-centre region. Page requests may process the IP address, time, requested resource, browser and device information, and technical security or error data.
DigitalOcean processes hosted customer data for us under a data-processing agreement. DigitalOcean is a US provider and uses subprocessors. Selecting Frankfurt as the storage region therefore does not mean that every support, administration or other processing operation takes place exclusively in Germany. DigitalOcean identifies the EU–US Data Privacy Framework and, where applicable, Standard Contractual Clauses as safeguards for necessary international transfers.
The legal bases are Article 6(1)(b) GDPR where hosting is required to perform a contract and Article 6(1)(f) GDPR. Our legitimate interest is the secure, stable and economical operation of the service.
↑ Back to contents3. Accounts and sign-in
PrimusKids accounts are for adults only. For sign-in and library access, we process the email address, adult confirmation, account role, assigned purchases and entitlements, and technical timestamps. Single-use sign-in links are stored only as hashes, expire after 30 minutes and may be used once. A necessary HTTP-only session cookie maintains the session for no more than 30 days.
Processing is necessary to take steps before and perform a contract under Article 6(1)(b) GDPR and to protect accounts under Article 6(1)(f) GDPR. We cannot provide sign-in, purchase assignment or library access without a reachable email address.
We do not create child accounts or request children’s names, dates of birth, photographs, voices or developmental profiles.
↑ Back to contents4. Purchases and Paddle Checkout
Paddle is intended to serve as Merchant of Record for live sales. The purchase contract and payment processing take place in Paddle Checkout. Payment and card details are sent directly to Paddle and are not stored on PrimusKids systems. Paddle processes buyer, billing, payment, tax, fraud-prevention and transaction data under its own responsibility as a controller.
PrimusKids receives the confirmation required for access and support, including buyer email, transaction ID, product and price mapping, status, amount and currency. Signed payment notifications grant access and end it after a refund or cancellation. The legal bases are Article 6(1)(b) and (c) GDPR and, where required, our legitimate interests in fraud prevention, evidence and secure fulfilment under Article 6(1)(f) GDPR.
Paddle operates internationally. Depending on the relevant Paddle entity and service providers, data may be processed outside the EEA. Paddle identifies adequacy decisions and Standard Contractual Clauses as relevant safeguards.
↑ Back to contents5. Free sampler, email and marketing
When an adult requests a free sampler, we process their email, language, audience segment, confirmation status, consent wording and timestamps to provide the requested service. The confirmation link expires after 30 minutes. Necessary delivery and access messages rely on Article 6(1)(b) GDPR.
Optional marketing email is separate and is sent only after explicit consent under Article 6(1)(a) GDPR. Consent may be withdrawn at any time for the future.
We use Resend, a service of Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA, for requested-plan, sign-in, purchase and access email. This processes in particular the recipient email, language, message content, and delivery or error data. Resend acts as processor under a data-processing addendum and identifies the EU–US Data Privacy Framework and Standard Contractual Clauses for transfers to the United States. Its DPA states that customer data is generally deleted within 90 days after the agreement ends. PrimusKids does not send child data.
↑ Back to contents6. Audience measurement and browser storage
Necessary storage maintains sign-in, language and the privacy choice. The language cookie lasts up to one year, the consent cookie up to 180 days and the session cookie up to 30 days.
Minimal first-party audience measurement stays off until explicitly permitted. After consent, we store a random identifier in the browser and record event name, time, language, landing path, source and, where relevant, product reference. No child profile is created. Consent under section 25(1) TDDDG is the basis for storing or reading the optional identifier; subsequent processing relies on Article 6(1)(a) GDPR. Selecting essential storage removes the identifier from the browser.
↑ Back to contents7. Retention
We keep personal data only for as long as its purpose requires. Session and link periods are stated above. Accounts and entitlements are generally retained for the customer relationship and then deleted or anonymised unless statutory duties or legal claims require otherwise. Commercial and business correspondence and other tax-relevant records are generally retained for six years, accounting vouchers for eight years, and commercial records, annual accounts and comparable records for ten years. These periods generally start at the end of the relevant calendar year. Paddle determines the periods for data it processes under its own responsibility. Consent and withdrawal evidence is retained for as long as necessary to demonstrate compliance.
Technical access, security and error logs are generally deleted after 30 days. If a specific security incident occurs, the relevant extracts may be retained longer while the incident is investigated or legal claims are pursued or defended. Optional audience data is deleted or anonymised when its purpose ends.
↑ Back to contents8. Individual rights
Subject to the GDPR, individuals have rights including access, rectification, erasure, restriction, data portability and objection. Consent can be withdrawn at any time for the future. Statutory retention duties and overriding third-party rights may limit erasure.
Complaints may be lodged with a data-protection authority. The authority generally competent for the Dresden-based controller is the Saxon Data Protection and Transparency Commissioner, Maternistraße 17, 01067 Dresden, Germany.
↑ Back to contents9. Version and changes
Version: 25 August 2026. We will update this notice when features, providers or applicable law change. Production providers that are not yet active will only be used after the necessary agreements are in place and this notice has been updated accordingly.
↑ Back to contents