This translation is provided for information only. The German version is the legally binding one. Read the German version
Some details are still being completed and will be published once finalised.
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection provisions is:
ZUB Deutsch GmbH
Viktoriastraße 10
44787 Bochum
Germany
E-mail: info@zub-deutsch.de
Telephone: still being completed
Managing directors: Anita Zub and Sandra Zub-Schaal
Commercial register: Amtsgericht Bochum (Bochum Local Court), HRB 23535
2. General information on data processing
We process personal data only to the extent necessary to provide our website, to communicate with prospective and current participants, to carry out bookings and contracts and to organise our language courses, or where another legal basis exists.
Depending on the processing, the legal bases considered are in particular Art. 6 (1)(a) GDPR (consent), Art. 6 (1)(b) GDPR (contract or pre-contractual measures), Art. 6 (1)(c) GDPR (legal obligation) and Art. 6 (1)(f) GDPR (legitimate interests).
3. Visiting our website and server log files
When you visit our website, technically necessary data may be processed by the hosting provider. This may include in particular the IP address, the date and time of access, the page or file requested, the volume of data transferred, the browser type and version, the operating system, the referrer URL and status messages.
The processing serves to provide the website securely, stably and free of technical errors. The legal basis is generally Art. 6 (1)(f) GDPR. Our legitimate interest lies in providing our web presence securely and reliably.
Hosting provider: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.
Server location: Nuremberg, Germany. Data is processed exclusively within the European Union.
Retention period for log files: 7 days. IP addresses are shortened before they are stored.
Where a data processing agreement with the hosting provider is required, it is concluded in accordance with Art. 28 GDPR.
4. Contacting us
If you contact us by e-mail, by telephone or via a contact form where one is provided, we process the data you provide in order to handle your enquiry and any follow-up questions.
Where your enquiry is directed at concluding or performing a contract, the processing takes place on the basis of Art. 6 (1)(b) GDPR. In other cases the processing may be based on Art. 6 (1)(f) GDPR. Our legitimate interest lies in handling enquiries appropriately.
The data is deleted as soon as it is no longer required for the respective purpose and no statutory retention obligations or other legal grounds prevent deletion.
5. Registration and course administration via KURSO
For registration for our courses and the associated participant and booking administration, we use the external booking and administration system KURSO. When you move from our website to KURSO, personal data is processed as part of the booking process there.
Depending on the booking, the data processed may include in particular your name, address, contact details, the course booked, invoicing and payment information, the booking status and further details required to perform the contract.
KURSO acts as a technical intermediary for booking, participant administration and payment processing. The contracting party with regard to the language courses offered by ZUB Deutsch remains ZUB Deutsch GmbH.
The processing takes place in particular to carry out pre-contractual measures and to perform the course contract pursuant to Art. 6 (1)(b) GDPR and, where statutory retention obligations exist, pursuant to Art. 6 (1)(c) GDPR.
Provider/operator of KURSO: Henke Informatik GmbH still being completed.
Processing on behalf / allocation of roles: still being completed.
6. Payment processing
The payment methods available during the booking process are shown via KURSO. Depending on the payment method chosen, data may be transmitted to the payment service provider used in order to process the payment. This may include in particular your name, invoicing data, the payment amount, transaction data and the payment information required for the respective payment method.
The processing generally takes place in order to perform the contract pursuant to Art. 6 (1)(b) GDPR. Where payment service providers process data under their own data protection responsibility, their privacy information applies in addition.
Bank transfer – processing of the banking and booking data required for the payment and its allocation.
Stripe – still being completed.
7. Placement, participant administration and course delivery
In the course of registration, placement and delivery of our language courses, personal data required to organise and deliver the respective course may be processed. This may include in particular contact details, information on your level of language ability, placement results, course assignment, attendance data, communication data and details relating to the issuance of attendance confirmations.
The processing generally takes place in order to perform the contract pursuant to Art. 6 (1)(b) GDPR. Where statutory documentation or retention obligations exist, the processing takes place on the basis of Art. 6 (1)(c) GDPR.
Attendance data is processed in particular for course organisation and – where provided for – to establish whether the requirements for attendance confirmations are met.
8. Online courses and Microsoft 365 / Microsoft Teams
Where online courses are held via Microsoft Teams or Microsoft 365, personal data required to hold the online event is processed. This may include in particular your name, contact details, user/meeting data, communication content, technical connection data and – where used voluntarily – camera and audio data.
The processing generally takes place in order to perform the course contract pursuant to Art. 6 (1)(b) GDPR.
Provider: Microsoft still being completed.
Recordings: ZUB Deutsch does not, as a rule, record online classes without the legal basis or consent of the persons concerned required for this.
9. Cookies and similar technologies
Our website may use cookies and similar technologies. Technically necessary technologies may be used to the extent required to operate the website. For cookies that are not technically necessary, or comparable access to terminal equipment, consent is obtained in advance where required by law.
Cookie/consent tool: not used.
Non-essential cookies/tracking: not used.
10. Reach measurement, analytics and error monitoring
Analytics, statistics or error monitoring services are only described where they are actually used.
Current status: No analytics, statistics or error monitoring services are used.
11. Embedded content and external links
Our website may contain links to external offerings. Merely setting a link does not as a rule transfer any personal data to the operator of the linked page. The privacy provisions of the respective provider apply only once the external page is accessed.
12. Recipients of personal data
Personal data is only passed on to recipients where this is permitted in order to perform the contract, to fulfil legal obligations, on the basis of a legitimate interest or on the basis of consent. Recipients may include in particular IT and hosting service providers, KURSO, payment service providers, tax and accounting service providers as well as – where required – further service providers engaged to deliver our services.
Where service providers process personal data on our behalf, we conclude – where required – data processing agreements pursuant to Art. 28 GDPR.
13. Transfers to third countries
Where personal data is transferred to recipients outside the European Union or the European Economic Area, this only takes place in compliance with the statutory requirements of Art. 44 et seq. GDPR. Depending on the service used, adequacy decisions, appropriate safeguards such as standard contractual clauses or other transfer bases provided for by law may in particular be relevant.
14. Retention period
We generally store personal data only for as long as this is required for the respective processing purpose. The data is then deleted unless statutory retention periods, the assertion or defence of legal claims or other permissible grounds require further storage.
The applicable statutory retention periods apply to documents relevant under commercial and tax law.
15. Your rights
Subject to the statutory requirements, data subjects have in particular the following rights:
right of access under Art. 15 GDPR,
right to rectification under Art. 16 GDPR,
right to erasure under Art. 17 GDPR,
right to restriction of processing under Art. 18 GDPR,
right to data portability under Art. 20 GDPR,
right to object under Art. 21 GDPR, and
the right to withdraw consent once given at any time with effect for the future.
To exercise your rights, you can contact ZUB Deutsch GmbH at info@zub-deutsch.de.
16. Right to object
Where we process personal data on the basis of Art. 6 (1)(e) or (f) GDPR, you have the right under Art. 21 GDPR to object at any time to the processing on grounds relating to your particular situation. In the case of direct marketing, a right to object exists without any need to state particular grounds.
17. Right to lodge a complaint with a supervisory authority
Under Art. 77 GDPR you have the right to lodge a complaint with a data protection supervisory authority. This applies in particular to the supervisory authority of your habitual residence, your place of work or the place of the alleged infringement.
For a company established in North Rhine-Westphalia, the competent data protection supervisory authority of the State of North Rhine-Westphalia is the relevant one.
18. Obligation to provide data
When booking a course, the personal data required to conclude and perform the contract must be provided. Without this data, a booking or the proper delivery of the course may not be possible. Any voluntary details beyond this are treated as such.
19. Automated decision-making
Decision-making based solely on automated processing, including profiling within the meaning of Art. 22 GDPR, does not as a rule take place, unless expressly stated otherwise in this privacy policy.
20. Data security
We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access and other risks. The website is provided exclusively over encrypted HTTPS.
21. Updates to this privacy policy
We reserve the right to adapt this privacy policy if legal requirements, our services or the technical services used change. The current version published on our website applies.