Privacy policy
We only process what we need for the mentoring programme. No tracking cookies, no sharing with companies, no AI.
This is a translation for your convenience. Only the German version is legally binding.
Who is responsible
Simon Feldhusen, Paul Swietlik, Till Schreiner
c/o AStA am KIT, Adenauerring 7, 76131 Karlsruhe
hallo@kite-karlsruhe.stec-online.com
We are joint controllers (Art. 26 GDPR) and have agreed that all requests go to hallo@kite-karlsruhe.stec-online.comand that we answer them together. You can also exercise your rights with each of us individually.
Visiting the website
- Data
- IP address, browser, page visited, time
- Purpose
- Delivering the pages, operation and security
- Legal basis
- Art. 6(1)(f) GDPR, legitimate interest in secure operation
- Service
- Vercel Inc., USA, data centre in Frankfurt am Main. The provider is certified under the EU-US Data Privacy Framework (Art. 45 GDPR), and the contract also contains standard contractual clauses.
- Storage period
- The provider’s logs, only briefly
Protection when sending codes
- Data
- Browser and device characteristics, IP address
- Purpose
- Preventing codes from being sent en masse
- Legal basis
- Art. 6(1)(f) GDPR. Access to your device is permitted under § 25(2) no. 2 TDDDG because it is strictly necessary for the code you requested.
- Service
- Cloudflare Turnstile, Cloudflare Inc., USA. Only when you request a code. The provider is certified under the EU-US Data Privacy Framework (Art. 45 GDPR), and the contract also contains standard contractual clauses.
- Storage period
- According to the provider, only briefly
Signing in with a code
- Data
- Email address (for first-year students, the address of your account), time, a session cookie after confirmation
- Purpose
- Confirming that the email address belongs to you, and keeping you signed in
- Legal basis
- Art. 6(1)(b) GDPR
- Service
- Supabase, servers in Frankfurt am Main. Contract with standard contractual clauses.
- Storage period
- Codes after 24 hours, the account like the application
Counting code requests and failed attempts
- Data
- Email address and time of every code request and every wrong entry, nothing else
- Purpose
- At most 5 codes per address and hour; after 5 wrong entries, a new code is needed. This way, codes cannot be guessed and addresses cannot be flooded with emails.
- Legal basis
- Art. 6(1)(f) GDPR, legitimate interest in secure operation
- Service
- Supabase, servers in Frankfurt am Main. Contract with standard contractual clauses.
- Storage period
- 24 hours
Confirming your KIT email address and another address
- Data
- KIT email address, another address if you wish, time of confirmation. We only store the code as a check value (hash).
- Purpose
- The KIT email address shows that you study at KIT and ensures that each person applies only once. We only use the other address for your result and reminders.
- Legal basis
- Art. 6(1)(b) GDPR. The other address is voluntary.
- Service
- Supabase, servers in Frankfurt am Main. Contract with standard contractual clauses.
- Storage period
- Codes after 24 hours, the addresses like the application
Application as a first-year student
- Data
- The address of your account, first and last name, degree programme, age group (18 or older, 16 or 17, younger than 16), your answers to the required questions, topics, how you would prefer to meet, your commitment with the time and the version of the notes you saw. Voluntary: preferred name, whether you have studied before, whether you moved to Karlsruhe, your experience (type, activity, organisation, place, period, one sentence), interests, hobbies, what your mentor should know about you, a wish regarding your mentor, how you heard about us (also via a QR code). In addition, from us: a number for the shortlisting, scores and notes from the assessment.
- Purpose
- Review, assessment without your name, shortlisting, forming the tandems, running the mentoring programme, invitations to seminars
- Legal basis
- Art. 6(1)(b) GDPR, pre-contractual measures at your request. The same applies to the voluntary information, which you can leave out.
- Service
- Supabase, servers in Frankfurt am Main. Contract with standard contractual clauses.
- Storage period
- Until the end of the programme on 31 March 2027, including drafts that were never submitted and accounts without an application
Views and favourites
- Data
- Which mentor viewed a profile in the shortlist and when, the mentors’ favourites
- Purpose
- Protecting applicants, forming the tandems, checking whether the selection was fair
- Legal basis
- Favourites: Art. 6(1)(b) GDPR. Log of views: Art. 6(1)(f) GDPR, legitimate interest in protecting applicants.
- Service
- Supabase, servers in Frankfurt am Main. Contract with standard contractual clauses.
- Storage period
- Until the end of the programme on 31 March 2027
Application as a mentor
- Data
- Name, KIT email address, degree programme, semester, your texts and experience, topics, what you are particularly good at, whether you would give a seminar, whether you meet on campus or online, contact method, commitments. Voluntary: gender, hobbies, phone number, LinkedIn profile, how you heard about us.
- Purpose
- Review and approval, forming the tandems, running the mentoring programme, planning seminars, certificate
- Legal basis
- Art. 6(1)(b) GDPR
- Service
- Supabase, servers in Frankfurt am Main. Contract with standard contractual clauses.
- Storage period
- Until the end of the programme on 31 March 2027
Emails
- Data
- Email address, content, delivery status
- Purpose
- Codes, confirmation of receipt, reminders, result and information about the process
- Legal basis
- Art. 6(1)(b) GDPR
- Service
- Resend (Plus Five Five, Inc.), USA. Without open and click tracking. The provider is certified under the EU-US Data Privacy Framework (Art. 45 GDPR), and the contract also contains standard contractual clauses.
- Storage period
- In our sending log, address and error messages for 90 days. After that, only an entry without the address remains until the end of the programme, so that no email goes out twice.
Contact for events and the next round
- Data
- Email address, degree programme
- Purpose
- For first-year students: invitations to open events and seminars and a message when the next round starts, even without a place. For mentors: a message when the next round starts.
- Legal basis
- Art. 6(1)(a) GDPR, your consent in the form. Voluntary and can be withdrawn at any time.
- Service
- Supabase, servers in Frankfurt am Main. Contract with standard contractual clauses.
- Storage period
- Until 31 October 2027 or until you withdraw your consent
Log
- Data
- Who submitted, withdrew, opened, changed or exported an application and when, status changes with questions from the organising team, how much the nightly deletion job deleted
- Purpose
- Tracing who accessed applications, and protecting applicants
- Legal basis
- Art. 6(1)(f) GDPR, legitimate interest in secure and traceable operation
- Service
- Supabase, servers in Frankfurt am Main. Contract with standard contractual clauses.
- Storage period
- 12 months
Who sees your information as a first-year student
- The organising team sees your application. The assessment is done without your name, with a number and your experience without organisation and place.
- If you are shortlisted, the mentors of your degree programme see, while they choose their favourites, your preferred name with a number (e.g. “Lena · #4”), your answers to the required questions, topics, interests, hobbies, how you would prefer to meet, and your experience without organisation and place. We log every view.
- Your last name, KIT email address, the organisation and place of your experience, what your mentor should know about you, whether you have studied before, whether you moved to Karlsruhe and whether you are under 18 are only seen by your own mentor, and only after you have accepted your place.
- Only the organising team sees your wish regarding your mentor.
- No mentor sees the address of your account or another address.
We do not pass any data on to companies, partners or guests at our events.
Who sees your information as a mentor
The organising team sees your application in order to approve you. If a first-year student is offered you as a mentor, they see your first name, degree programme, semester and introduction in the offer. After accepting, your mentee also sees your last name, contact method and, if provided, your LinkedIn profile. First-year students on the shortlist see nothing about you. We do not pass any data on to companies, partners or guests at our events.
If you are not yet 18
From 16, you apply yourself. If you are younger than 16, you can fill everything in, but you can only submit once we have clarified with your parents what is necessary. If you are not yet 18, your mentor only learns this after you have accepted your place, so that you can choose suitable places and occasions. We only take photos at events with consent, and for under-16s with your parents’ consent.
No AI, no automated decisions
People decide on your application. We do not use AI anywhere in the process. An algorithm suggests the tandems based on the mentors’ favourites. The organising team checks and approves every suggestion. There are no decisions based solely on automated processing within the meaning of Art. 22 GDPR.
What is stored on your device
After you sign in, a session cookie that is technically necessary. If you choose a language in the switcher, your browser remembers it for one year in a technically necessary cookie. We store your application as a first-year student on our server, not in your browser. Your browser stores the draft of the mentor form for up to 7 days; it only leaves your device when you submit it. We do not use tracking cookies, pixels or analytics services.
What is required and what is voluntary
We need the required information in the forms to review your application and run the mentoring programme. Without it, we cannot consider you. Anything marked as optional can be left out.
Your rights
- Access to the data we store about you
- Rectification, erasure and restriction of processing
- Data portability
- Objection to processing based on Art. 6(1)(f) GDPR
- Withdrawal of consent, with effect for the future
To do so, write to us at hallo@kite-karlsruhe.stec-online.com. When providing access, we protect other people’s information (Art. 15(4) GDPR), for example who chose you as a favourite. You can also lodge a complaint with the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg.
Deletion
We delete according to the periods above, and every deletion is logged. Backups delay deletions by up to 7 days. If you withdraw your application as a first-year student, we delete its contents immediately. If you delete your account, we delete everything, including your sign-in data.
We answer questions about the process by email at hallo@kite-karlsruhe.stec-online.com.
Version of 6 October 2026