Privacy Policy

1. Controller

2. Hosting and Server Log Files

Our website is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. A data processing agreement (Art. 28 GDPR) is in place with Hostinger.

When you visit the website, technically necessary data is processed, such as your IP address, date and time, the pages accessed, and browser and device information. This serves the secure provision of the website, error analysis and the prevention of misuse (Art. 6(1)(f) GDPR). Log data is stored only for as long as is necessary for these purposes.

3. Cookies and Consent Management

We use technically necessary cookies (Section 25(2) TDDDG). For all other cookies and services, we obtain your consent in advance (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).

To manage your consents, we use the WordPress plugin Complianz. Services that require consent are loaded only after you have given your consent. Your selection is stored on your device in cookies with the prefix cmplz_ for up to 365 days; no data is transmitted to the provider of the plugin in the process (Art. 6(1)(c) GDPR).

You can change or withdraw your consent at any time with effect for the future: via “Manage consent” on any page or here: Open cookie settings. You can find all cookies in our Cookie Policy.

4. Contact, WhatsApp and BBL Plus

If you contact us via form, email, telephone or WhatsApp, we process your details (in particular name, contact details and message content) in order to handle your request. This also applies to inquiries about our BBL Plus services (blocked account, health insurance, visa, accommodation). The legal basis is Art. 6(1)(b) GDPR for contract-related inquiries and Art. 6(1)(f) GDPR otherwise. Data is passed on to external partners only if this is necessary for a service you have requested.

When you use WhatsApp (+49 178 8498906), data is also processed by WhatsApp Ireland Limited; transfers to third countries may take place in the process. Please do not send sensitive documents via WhatsApp; alternatively, you can reach us by email or telephone.

5. Course Registration, Exams and Contract Processing

For consultation, placement, registration, teaching, exams, certificates, invoices and payments, we process the necessary master data, contact data, course data, exam data and payment data (Art. 6(1)(b) and (c) GDPR). For registered exams, we transmit the necessary data to the responsible exam provider, for example telc or a university; payment data is transmitted to banks or payment service providers where required.

6. Moodle

We use the learning platform Moodle for our digital learning environment. In doing so, name, email address, login credentials, course affiliation, learning progress, assignments, test results and messages are processed (Art. 6(1)(b) GDPR). Your account is deleted after you have completed the course, unless proof or retention obligations prevent this.

7. Zoom

We use Zoom (Zoom Communications, Inc., USA) for online teaching. The data processed includes display name, contact details, IP address, device information and, depending on use, audio, video and chat content (Art. 6(1)(b) GDPR). Zoom is certified under the EU-US Data Privacy Framework. Recordings are made only after prior notification and with your consent.

8. Applications

We process application documents in order to decide on an employment relationship (Art. 6(1)(b) GDPR). If your application is unsuccessful, the documents are deleted no later than six months after the conclusion of the procedure.

9. Google Analytics

With your consent, we use Google Analytics 4 provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics is loaded only once you agree to the “Statistics” category (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

The data processed includes usage data such as pages accessed, time spent, approximate location, device and browser. According to Google, Google Analytics 4 does not store IP addresses. The cookies _ga and _ga_* are stored for up to two years, and event data for a maximum of 14 months. A transfer to Google LLC in the USA is possible (EU-US Data Privacy Framework).

10. Google Maps, reCAPTCHA and Fonts

Google Maps: To display our location, we embed Google Maps (Google Ireland Limited). The map is loaded only after you have given your consent; in this process, in particular your IP address and device information are transmitted to Google, including to the USA (Art. 6(1)(a) GDPR).

Google reCAPTCHA: To protect our forms against spam, we use Google reCAPTCHA (Google Ireland Limited). reCAPTCHA evaluates usage data such as IP address and mouse movements and is loaded only after you have given your consent (Art. 6(1)(a) GDPR). Without your consent, you can reach us by email, telephone or WhatsApp.

Fonts: The fonts used are loaded locally from our server; no connection to Google is established in the process.

11. Storage Period

We store data only for as long as it is necessary for the respective purpose. Statutory retention periods remain unaffected, in particular six years for business letters, eight years for accounting vouchers and ten years for books and annual financial statements (Section 257 HGB, Section 147 AO).

12. Transfers to Third Countries

In the case of Google Analytics, Google Maps, Google reCAPTCHA, Zoom and WhatsApp, data may be transferred to the USA. We base this on the adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR), where the recipient is certified, and otherwise on EU Standard Contractual Clauses (Art. 46 GDPR).

13. Your Rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consents at any time with effect for the future (Art. 7(3) GDPR). To do so, please contact [email protected].

14. Right to Object

15. Right to Lodge a Complaint

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular with the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, www.ldi.nrw.de.