1. Controller / Responsible Entity

Responsible for data processing:
BBL Sprachschule gGmbH
Musterstraße 1, 12345 Muster City
Phone: +49 178 8498906
E-Mail: office@bbl-sprachschule.de

Data Protection Officer: [Name/Contact]
(or: “No Data Protection Officer appointed, as not required by law”)

2. General Information on Data Processing

We process personal data only to the extent necessary to provide this website,
to enable communication, and to conduct courses and examinations.

Legal bases: Art. 6(1)(a) GDPR (consent), (b) (contract/pre-contract), (c) (legal obligation), and (f) (legitimate interest) GDPR, as well as § 25 TTDSG (device access/cookies).

3. Cookies Consent-Management

We use technically necessary cookies and – with your consent – optional cookies (e.g., for statistics/marketing).

• technically necessary: Art. 6(1)(f) GDPR in conjunction with § 25(2) TTDSG
  
• all others: Consent (Art. 6(1)(a) GDPR, § 25(1) TTDSG)
  

Consent-Tool: [Name/Anbieter des Cookie-Banners, Link].

Revocation/changes: possible at any time in the cookie center: [link/mechanism].

4. Kontakt Anfragen (Formular, E-Mail, Telefon, WhatsApp)

When you contact us, we process your information (name, contact details, content of the message) for handling your request.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual communication) or (f) GDPR (handling inquiries).

Storage period: usually 6–24 months, unless retention obligations prevent deletion.

Note on WhatsApp (if used): Data processing by WhatsApp Ireland/Meta; please use this channel only if you agree.

5. Course Registration, Consultation Contract Processing

For course/exam registrations, placement, invoicing, and participant management, we process in particular: personal data, contact details, course data, payment references, and, if necessary, educational background/language level.

Legal basis: Art. 6(1)(b) GDPR (contract/pre-contract), and if applicable, (c) (legal obligations).

Recipients: internal administration, and if applicable, exam providers (e.g., telc gGmbH, TestDaF Institute, Goethe Institute, DSH examination centers).

Payment processing: transmission of required data to banks or payment service providers (e.g., PayPal).

Storage period: contract and billing data are generally stored for 10 years according to HGB/AO.

6. User Account E-Learning (e.g. Moodle)

For the use of our online learning platform [Moodle/…], we process registration data (name, email), course assignments, activity data (e.g., submissions, tests), and communication within the course.

Legal basis: Art. 6(1)(b) GDPR (fulfillment of the teaching contract)

Provider/Hosting: [own server at … / external provider incl. address] (data processing agreement, Art. 28 GDPR).

Storage period: until the end of the course plus [e.g., 12 months] or until deletion of the account.

7. Video Conferences for Online Teaching (e.g. Zoom)

We use [Zoom/Microsoft Teams/…] for live teaching. Data processed: display/account data, metadata (IP, device information), communication content (video/audio/chat – depending on usage).

Legal basis: Art. 6(1)(b) GDPR (teaching/exams) or (a) (recordings only with consent).

Provider: [Zoom Video Communications, Inc./…]; where applicable, data transfer to third countries (USA) with standard contractual clauses (Art. 46 GDPR).

Note: Camera/microphone are required for participation in lessons; recordings only with prior notice and consent.

8. Applications (Teaching Staff Administration)

For applications, we process your documents (name, contact details, qualifications, certificates).

Legal basis: Art. 6(1)(b) GDPR in conjunction with § 26 BDSG

Storage period: 6 months after completion of the application process, unless explicit consent has been given for longer retention.

9. Photos Videos at Courses / Events

At events or during classes, photos/videos may be taken and possibly used for the website or social media.

Legal basis: Art. 6(1)(a) GDPR (consent). Participation is also possible without giving consent

Consents can be withdrawn at any time with future effect

10. Newsletter

When registering for the newsletter, we store your email address and the time of registration/confirmation (double opt-in).

Legal basis: Art. 6(1)(a) GDPR

Unsubscription: possible at any time via the link in the newsletter

Service provider: [e.g., Brevo/Mailchimp] (data processing agreement; possibly third country with SCC)

11. Web Analytics

Variant A – Google Analytics (with IP anonymization)

Provider: Google Ireland Limited, Dublin. Legal basis: Consent (Art. 6(1)(a) GDPR; § 25(1) TTDSG). Data transfer: USA with standard contractual clauses. Storage period: [e.g., 14 months]

Variant B – Matomo (self-hosted)

With local installation without third-party providers and without cookies, we process pseudonymized usage data. Legal basis: Art. 6(1)(f) GDPR (legitimate interest) or – when using cookies – consent

Note: Please keep only the variant actually used

12. Embedded Content

YouTube (extended data protection mode): data processing only after active playback. Google Maps: displaying the school location. Web fonts: preferably locally; external fonts (e.g., Google Fonts) only with consent.

Legal basis: Art. 6(1)(a) GDPR; § 25 TTDSG

13. Storage Period

We store personal data only as long as necessary for the purposes or as required by legal retention obligations. Afterwards, the data will be deleted or anonymized.

14. Data Security

We use up-to-date technical and organizational measures (e.g., SSL/TLS encryption) to protect data against loss, misuse, and unauthorized access.

15. Data Transfers to Third Countries

If data is transferred to countries outside the EU/EEA (e.g., with Zoom/Google/Meta), we comply with the provisions of Art. 44 ff. GDPR (especially standard contractual clauses) and implement additional safeguards.

16. Rights of Data Subjects

You have the following rights (Art. 15–21 GDPR): access, rectification, deletion, restriction, data portability, objection (in case of Art. 6(1)(f)), and withdrawal of consent given, with effect for the future.

Contact for exercising rights: datenschutz@bbl-sprachschule.de. We may require proof of identity

17. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. Competent authority (example NRW): State Commissioner for Data Protection and Freedom of Information NRW – www.ldi.nrw.de

18. Minors

Our services are primarily intended for adults. Persons under 16 may only provide data with the consent of their legal guardians (Art. 8 GDPR).

19. Changes to this Privacy Policy

We update this notice when the legal situation or our services change. The current version is always available at [URL of this page]

Status: September 2, 2025