1. Overview

This policy explains how we handle personal data when you visit this website and when you send us feedback through our online contribution form. We are committed to processing personal data lawfully, transparently and in accordance with the EU General Data Protection Regulation (GDPR) and applicable German data protection law.

  1. Who is responsible

The controller responsible for the processing of personal data described here is:

Zentrum für KI-Risiken & -Auswirkungen gUG (haftungsbeschränkt)
Prenzlauer Allee 186
D-10405 Berlin
Email: info@kira.eu
Represented by: Daniel Privitera, CEO

  1. Data protection officer

We have not appointed a data protection officer. Based on the nature and scale of our processing, we are not required to designate one under Article 37 GDPR or § 38 BDSG. 

  1. What personal data we process

4.1 When you visit this website

When you access the website, our hosting provider automatically collects and stores technical information that your browser transmits, in server log files. This typically includes:

  • your IP address;

  • the date and time of the request;

  • the page or file requested and the amount of data transferred;

  • your browser type and version, and operating system;

  • the referring website, where applicable.

This data is processed to deliver the website reliably and securely and to prevent and investigate misuse. Our website is created and hosted using Framer (Framer B.V., Singel 258, 1016 AB Amsterdam, Netherlands), who provides the platform and infrastructure and processes this log data on our behalf as our processor. Framer's hosting runs on Amazon Web Services infrastructure located in the United States (see §7 on international transfers).

4.2 Cookies and analytics

This website uses Framer's built-in analytics to understand how the site is used, for example page views, unique visitors, referring sources, countries and devices. Framer Analytics uses a privacy-first model: it does not use cookies and does not rely on persistent identifiers. Unique visitors are measured only within a one-day window, and the resulting statistics are aggregated and cannot be traced back to you as an individual. For details, see Framer's privacy statement at framer.com/legal/privacy-statement.

Because we do not set any non-essential cookies and use no third-party tracking, advertising or analytics scripts, this website does not require a cookie consent banner, and we do not display one.

4.3 When you contribute through our feedback form

Our contribution form is provided using Google Forms. When you submit the form, we process the information you choose to give us, which includes:

  • your name;

  • your email address;

  • your organisation and role or type of actor;

  • the substantive answers and free-text comments you provide.

Providing this information is entirely voluntary. By providing your email address, you agree for us to contact you.

  1. Purposes and legal bases

We process the data described above for the following purposes and on the following legal bases:

  • Operating and securing the website (§4.1): our legitimate interest in providing a functional, secure website (Article 6(1)(f) GDPR).

  • Considering your input for the Transformative AI Strategy (§4.2): our legitimate interest in gathering expert and stakeholder feedback to inform an independent policy strategy (Article 6(1)(f) GDPR).

  • Contacting you about your contribution, where you provide contact details and ask us to, and, where applicable, quoting or attributing your input (see §10): your consent (Article 6(1)(a) GDPR).

Where processing is based on consent, you may withdraw it at any time with effect for the future, without affecting the lawfulness of processing carried out before withdrawal (see §12). Where we rely on legitimate interests, you have the right to object (see §12).

  1. Recipients and processors

We use carefully selected service providers who process personal data on our behalf as processors under Article 28 GDPR, bound by data processing agreements:

  • Framer (Framer B.V., Singel 258, 1016 AB Amsterdam, Netherlands): Creation, hosting and delivery of this website, including the processing of server log data described in §4.1. Framer's hosting runs on Amazon Web Services infrastructure located in the United States.

  • Google (Google Ireland Ltd / Google LLC): Provision of the online contribution form (Google Forms) and associated storage within our Google Workspace environment.

Our use of Google Workspace is governed by Google's Cloud Data Processing Addendum, which forms part of the Workspace terms and serves as the Article 28 processing agreement. Our use of Framer is governed by the data processing agreement offered by Framer. We do not sell personal data, and we do not share it with third parties except as described in this policy or where required by law.

  1. International data transfers

Some of our processors are based in, or may process data in, the United States. Google LLC is certified under the EU–US Data Privacy Framework, which the European Commission recognises as providing an adequate level of protection for transfers to certified US organisations. Where data is transferred outside the EU/EEA to a recipient that is not covered by an adequacy decision, the transfer is safeguarded by the European Commission's Standard Contractual Clauses together with appropriate additional measures. 

  1. How long we keep your data

  • Server log data is processed by our hosting provider, Framer, for no longer than is necessary to operate and secure the website, and is deleted in accordance with Framer's retention practices and our data processing agreement. 

  • Contribution data is kept for as long as needed to develop and finalise the strategy and to respond to you, and is then deleted or anonymised, at the latest 12 months after publication of the strategy. Contributions we are permitted to quote or attribute (see §10) may be retained in the published strategy and its records.

  1. Is providing data required?

You are under no legal or contractual obligation to provide any personal data. Visiting the website does not require you to submit personal information, and contributing feedback is voluntary. If you choose not to provide contact details, we simply will not be able to follow up with you.

  1. Quotation and attribution

We may wish to quote contributions or name contributors in the strategy or related materials. We will only quote you by name or otherwise identify you as a contributor where you have given us your specific consent to do so. Unless you consent to attribution, we will treat your contribution as input to be used without identifying you. 

  1. Sensitive information

Please do not include special categories of personal data (such as information revealing health, political opinions, religious beliefs, or similar) in your free-text responses. We do not ask for such information and do not need it. If you include it voluntarily, we will handle it in accordance with this policy and delete it where it is not necessary for our purposes.

  1. Your rights

Subject to the conditions set out in the GDPR, you have the right to:

  • request access to the personal data we hold about you (Article 15);

  • request rectification of inaccurate data (Article 16);

  • request erasure of your data (Article 17);

  • request restriction of processing (Article 18);

  • receive your data in a portable format (Article 20);

  • object to processing based on our legitimate interests, on grounds relating to your particular situation (Article 21); and

  • withdraw consent at any time with effect for the future (Article 7(3)).

To exercise any of these rights, contact us at info@kira.eu.

  1. Right to lodge a complaint

If you believe our processing of your personal data infringes data protection law, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement. The authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61
10555 Berlin
Germany

  1. Changes to this policy

We may update this policy to reflect changes in our processing or legal requirements. The current version is always available on this website, with the effective date shown at the top.

back