Data protection

As of October 21, 2026

This privacy policy provides information about the processing of personal data on our website, in the online shop and on our learning platform, as well as in connection with inquiries, training courses, newsletter distribution and our social media presence.

1. Responsible parties and data protection officer

The data processing described below is the responsibility of Jennifer Ziegler – Praxistrainings-LMS, Kösters Kamp 11, 31840 Hessisch Oldendorf, Germany. Email: jennifer.ziegler@praxistrainings-lms.de. Phone: +49 5152 7800574.

You can reach our data protection officer, Aniko Koch, at datenschutz@praxistrainings-lms.de as well as by post to Praxistrainings-LMS, Attn: Data Protection Officer Aniko Koch, Kösters Kamp 11, 31840 Hessisch Oldendorf, Germany.

2. Purposes and legal bases

We process personal data to securely provide our website, answer inquiries, process orders and payments, conduct training, and provide learning certificates. Further processing relates to our office organization, voluntary surveys, and advertising and performance measurement, as explained below.

If you are a contractual partner, we process the data necessary for initiating and executing the contract in accordance with Article 6(1)(b) GDPR. For legal retention and documentation obligations, Article 6(1)(c) GDPR applies. For consent, Article 6(1)(a) GDPR applies. The specific consent determines its scope.

Article 6(1)(f) GDPR forms the basis for processing necessary for the purposes of legitimate interests, in particular secure IT operations, efficient business communication, and handling requests from company contacts. For participants whose employer concludes the contract, we base the necessary organization and execution of our training courses on Article 6(1)(f) GDPR. Our legitimate interests, as well as those of the booking employer, consist of providing the booked training course, managing learning access, and documenting course completion. In doing so, we take into account the interests and rights of the participants.

Required fields are marked in the respective form or order process. Without this information, we may not be able to process the request, order, or training service. Optional fields are marked accordingly. Consent to advertising is not a general requirement for participation in a paid training course.

3 Recipients and international processing

Data is only accessible to those individuals and entities that require it for their respective tasks. This includes authorized employees, IT service providers, hosting and software providers, payment service providers, and, in the case of group bookings, authorized group leaders. Where legally required, public authorities and tax or legal advisors may also be recipients.

Where service providers process data on our behalf, an agreement pursuant to Article 28 GDPR is required. Payment service providers and platform providers may carry out certain processing activities under their own responsibility.

An EU server location does not automatically preclude access from third countries or the use of subcontractors located there. For transfers outside the European Economic Area, the requirements of Articles 44 et seq. of the GDPR apply. In particular, an applicable adequacy decision or suitable safeguards such as standard contractual clauses, including any necessary supplementary measures, are required.

The following transfer principles apply to the services used. For US recipients, the adequacy decision of the EU-US Data Privacy Framework may apply, provided the specific company and processing activity are covered by a valid certification. Otherwise, agreed EU Standard Contractual Clauses pursuant to Article 46 GDPR and necessary supplementary measures may apply. For PayPal, approved binding corporate rules are particularly relevant for intra-group transfers. You can obtain information about the guarantees applicable to your data and a copy or access to it by contacting our data protection officer, provided that no third-party information requiring protection is infringed.

4. Website operation, hosting and technical security

Hosting via Logotio Sky and Cloudflare

Our website and learning platform are hosted by Logotio Sky. Our contracted hosting and IT service provider is Logotio Design, a brand of exhos LLC, 66 West Flagler Street, Suite 900 #6352, Miami, FL 33130, USA. Services include hosting, technical support, maintenance, and data backup.

When you visit our website, we process information such as your IP address, the date and time, the pages and files you request, status messages, browser and operating system information, and the previously visited page. When you use the shop and learning platform, the data you enter and generate for these functions is also processed on the hosting infrastructure.

Cloudflare Enterprise is used for the delivery and security of this website. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare processes connection data and technical requests for this purpose. This enables reliable delivery and the detection and prevention of unauthorized access. A main server location in Frankfurt does not preclude processing via the international Cloudflare network and access from third countries.

The legal basis for secure website operation is Article 6(1)(f) GDPR; our legitimate interest lies in an available and secure website. For processing operations necessary for the performance of a contract concluded with you, Article 6(1)(b) GDPR applies. Cloudflare's data processing terms apply. These stipulate the EU-US Data Privacy Framework and, additionally or alternatively, EU Standard Contractual Clauses for any data transfers to the USA. Further information: https://www.cloudflare.com/cloudflare-customer-dpa/. For other transfers to third countries, the conditions explained in section 3 apply.

Security and protocols

We use All-In-One Security and Patchstack Security to detect vulnerabilities and unauthorized access and to defend against attacks. This involves processing IP addresses, timestamps, requested URLs, browser information, and details of login attempts and security-relevant processes to the extent necessary. In connection with detected attacks, the content of affected requests may also be analyzed. This processing serves our legitimate interest in protecting the website and its users, in accordance with Article 6(1)(f) of the GDPR.

The provider of Patchstack services is Patchstack OÜ, Aida tn 7, 80011 Pärnu, Estonia. Insofar as security events are transmitted to its services, processing may take place by cloud subcontractors in the USA. The conditions set out in Section 3 apply to these transmissions. Further information: https://patchstack.com/privacy-policy/, https://patchstack.com/data-processing-agreement-dpa/ and https://patchstack.com/subprocessors/.

Access and security logs are retained only as long as necessary for operational monitoring, error analysis, and the prevention or investigation of security incidents. Information regarding a specific case of misuse may be stored until its complete resolution and any necessary legal action. Connections to our website are encrypted during transmission.

5 Cookies and consent management with Borlabs

Change cookie settings and withdraw consent

You can access your cookie settings at any time via the button below, change your selection, and revoke any consent you have given with effect for the future. The lawfulness of the processing carried out until the revocation remains unaffected.

[borlabs-cookie type="btn-cookie-preference" title="Cookie settings"/]

We use cookies and similar technologies. These enable, in particular, logging into your learning account, managing your shopping cart, ensuring security, and saving your privacy preferences. Technically essential storage or access is carried out in accordance with Section 25 Paragraph 2 of the German Telemedia Act (TMG). The associated processing of personal data is based on Article 6 Paragraph 1 Letter b or f of the GDPR, depending on the function.

For analysis, visitor tracking, advertising effectiveness measurement, and external media, we obtain your consent where necessary. The legal basis for this is Section 25 Paragraph 1 of the German Telemedia Act (TDDG) for storing or reading device information and Article 6 Paragraph 1 Letter a of the GDPR for the subsequent processing of personal data. Your consent is voluntary and can be withdrawn at any time.

We use the WordPress plugin Borlabs Cookie to manage your decision. Your selection is stored in a technically necessary cookie and assigned to the respective consent decision. The required documentation serves as proof of consent pursuant to Art. 7 para. 1 GDPR in conjunction with Art. 6 para. 1 lit. c GDPR; the technical management is based on our legitimate interest in a functional consent management system pursuant to Art. 6 para. 1 lit. f GDPR.

Further information about individual cookies, their providers, purposes, and expiration dates can be found in the Borlabs dialog. Session cookies are deleted after the session ends; other cookies remain stored for the duration specified therein or until you delete them yourself. Revoking your consent does not affect the lawfulness of processing prior to its receipt. You can also contact us to revoke your consent. datenschutz@praxistrainings-lms.de Please note: If you delete the Borlabs cookie in your browser and reload the website, the selection will be requested again. Data already stored with providers is not automatically deleted simply by deleting a cookie.

6. Inquiries, appointments and email

When you contact us, we process the contact and content data you provide, such as your name, company, email address, phone number, and your inquiry. We use Zoho Forms and Bookings for forms and appointment processes; for processing and assignment, we use Zoho CRM and email services. Appointment details include, in particular, your preferred date and time, contact information, and, if applicable, the reason for the appointment.

The legal basis for processing your data is Article 6(1)(b) GDPR for our own pre-contractual or contractual matters. For other inquiries and internal contacts, Article 6(1)(f) GDPR applies; our legitimate interest is the proper processing and documentation of the communication. Completed inquiries and appointment details will be deleted as soon as their processing is finished and no further communication, contract processing, statutory retention, or necessary legal defense justifies their storage.

Our email addresses are registered with ALL-INKL.COM – Neue Medien Münnich. Our business emails are sent via Zoho Mail. Shop and order emails are forwarded to ALL-INKL's SMTP service via WP Mail SMTP. Transmission via this SMTP service is encrypted using TLS. The sender and recipient addresses, content, attachments, and technical transmission information required for each message are processed. ALL-INKL's privacy policy can be found here: https://all-inkl.com/datenschutzinformationen/. Processing for necessary business correspondence is based on the aforementioned legal bases; statutory retention is based on Art. 6 para. 1 lit. c GDPR.

7 Shop, learning platform and group bookings

When you place an order through WooCommerce, we process, in particular, names, company and billing information, contact details, ordered services, amounts, and payment status. We use LearnDash on our website to provide the learning account and courses. Specifically, we process account IDs, login credentials in a technically protected form, course assignments, learning progress, and issued certificates. The learning area displays results from knowledge tests, including the number of correct answers, the score, and a percentage result.

The data is used for providing and managing training courses, documenting course completion, and offering support with technical or professional questions. The legal basis for this processing is Article 6(1)(b) GDPR for our own contracts and Article 6(1)(f) GDPR for the necessary processing of training courses provided to corporate clients. Legal documentation and invoice retention are governed by Article 6(1)(c) GDPR.

For group bookings, authorized group leaders can view the learning progress and certificates of the participants assigned to their group. This facilitates the organization of training and the verification of completed courses. User profiles are not public; a public community or dedicated mobile app is not provided.

Employers can book training courses for their employees via our platform. To do so, they provide us with the first and last name of each participant. An email address can be provided optionally; it is not required for setting up the learning account. Based on this information, we create the login credentials for the learning account on our website. These login credentials are typically provided to the booking employer for distribution to the participants. At the employer's request, learning accounts can also be set up using the participants' company email addresses. This privacy policy is accessible via our website and also describes the data processing involved in registrations by employers.

When an employer registers, we receive the aforementioned data from them. This information then applies in accordance with Article 14 of the GDPR. The following information explains the use of the learning platform and the access rights of group leaders. We determine the training content, exams, and certification criteria ourselves. Employers book our training services based on our terms and conditions. We process participant data for the execution and documentation of these training services under our own data protection responsibility. The employer is responsible for their own processing of employee data, in particular for the registration of their employees and their use of the provided training certificates.

Booked courses are accessible for 12 months from the booking date. Certificates, learning progress, and test results are deleted together 24 months after the booking date. After termination of the learning account, the associated account data is deleted unless other purposes or legal retention obligations apply. The retention period for learning data does not apply to invoices or other business documents that must be retained by law.

8 Payments with WooPayments and PayPal

For card payments, we use WooPayments with Stripe as our technical partner. For PayPal payments, we use WooCommerce PayPal Payments. To process your chosen payment, the necessary order, invoice, contact, transaction, and technical data are transmitted to the respective payment service providers. Card data is processed via the payment infrastructure. Specifically, we receive transaction IDs and payment status, as well as potentially limited information about the payment method.

The legal basis for the necessary payment processing is Article 6(1)(b) GDPR. For statutory accounting and retention obligations, Article 6(1)(c) GDPR applies. Necessary measures against payment fraud may be based on Article 6(1)(f) GDPR. The legitimate interests lie in securing payments and preventing misuse. Optional advertising or analytics functions are not automatically legitimized by this.

For European users, WooPayments is provided by WooCommerce Ireland Ltd., Grand Canal Dock, 25 Herbert Pl, Dublin, D02 AY86, Ireland. Automattic Inc. and WooCommerce, Inc., USA, are also responsible for certain processing activities. Automattic documents EU Standard Contractual Clauses for transfers outside the EEA. The technical payment partner, Stripe, is subject to its own transfer terms: These name Stripe, LLC as the US recipient and primarily rely on the Data Privacy Framework, where applicable, and secondarily on Standard Contractual Clauses. Further information: https://automattic.com/privacy/ and https://stripe.com/de/privacy as well as https://woocommerce.com/document/woopayments/account-management/partnership-with-stripe/ and https://stripe.com/de/legal/dta.

PayPal is provided for German accounts by PayPal (Europe) S.à rl et Cie, SCA, Luxembourg. Data may be processed in the USA, among other locations. Transfers within the PayPal Group are subject to approved Binding Corporate Rules. Further transfers are secured, depending on the recipient, by applicable adequacy decisions or suitable safeguards such as EU Standard Contractual Clauses. Further information: https://www.paypal.com/de/legalhub/paypal/bcr. Data protection information: https://www.paypal.com/de/legalhub/paypal/privacy-full. Payment providers may also process data independently to comply with their own legal obligations and for risk assessment. Their notices explain the respective recipients and retention periods.

9 ZOHO applications and internal organization

We use services from Zoho with an EU account at zoho.eu. The provider is Zoho Corporation GmbH, II. Hagen 7, 45127 Essen, Germany. Data protection contact: privacy@eu.zohocorp.com. The service data is stored in accordance with our EU account region and the data processing conditions in data centers within the European Economic Area.

We use Bookings for appointments, Forms for contact and registration forms, CRM for customer and contact management, Campaigns for email campaigns, and Mail for business correspondence. WorkDrive, Writer, and Sheet are used for file storage and editing of documents and spreadsheets. Sign is used for electronic signatures, Survey for surveys, Social for managing our social media presence, and Flow for linking and automating these business processes.

Depending on the process, names, professional contact details, company information, inquiries, appointment and contract data, document content, as well as technical usage and verification data are processed. For electronic signatures, this includes information about the signatory and documentation of the signature process. For surveys, we process the submitted responses and the information requested in the respective form. Automation processes use the data required for the respective business process. The following additional information applies to newsletters and SalesIQ.

The legal basis is Article 6(1)(b) GDPR, insofar as the processing is necessary for initiating or fulfilling a contract with you. For communication with company contacts and internal organization, Article 6(1)(f) GDPR applies; our legitimate interest lies in the orderly and efficient processing of our business processes. Legal obligations are processed in accordance with Article 6(1)(c) GDPR. Where processing is based on your consent, Article 6(1)(a) GDPR applies. Information on the storage period can be found in Section 18.

The EU account region does not preclude support access from third countries. In particular, Zoho Corporation Private Limited in India may be granted access for support and troubleshooting. Zoho specifies EU Standard Contractual Clauses and supplementary safeguards based on a transfer review for this purpose. Further service-related subcontractors and information: https://www.zoho.com/privacy/sub-processors.html, https://www.zoho.com/privacy/privacy-faq.html and https://www.zoho.com/de/privacy.html.

Visitor tracking with SalesIQ

We use Zoho SalesIQ to analyze visits and interactions on our website. Specifically, we process information such as pages viewed, the time and duration of visits, referring websites, and technical browser, device, and connection information. Cookies and similar identifiers may be used to recognize a browser. This analysis helps us understand interest in our offerings and how our website is used.

For visitor tracking requiring consent, Article 6 Paragraph 1 Letter a of the GDPR applies, and for access to end devices, Section 25 Paragraph 1 of the German Telemedia Act (TDDDG) applies. Your decision is managed via Borlabs. You can revoke your consent for the future. The data is stored for the analysis of visitor behavior and deleted or anonymized as soon as it is no longer needed for this purpose or the required consent no longer applies; any continuing permissible obligation to provide evidence remains unaffected.

10 newsletters and campaigns by downloads

Newsletter and registration

We send newsletters via Zoho CRM and use Zoho Campaigns for email campaigns. The messages contain information about our company, specialist topics, our training courses, services, promotions, and offers. For this purpose, we process your email address, and optionally your name for personalized greetings, as well as information regarding registration, delivery, and unsubscription.

Registration is generally carried out using the double opt-in procedure: After registering, you will receive an email with a confirmation link. Your registration is only confirmed after clicking this link. For documentation purposes, the registration and confirmation times, the content of your consent, and the associated technical data are processed. The sending of promotional materials is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR in conjunction with Section 7 para. 2 no. 2 of the German Unfair Competition Act (UWG).

You can unsubscribe at any time via the unsubscribe link in the messages or by email to datenschutz@praxistrainings-lms.de Unsubscribe. After unsubscribing, we will no longer use your data for further advertising. If we require proof of previously granted consent to defend against claims, we may retain this data for up to three years after unsubscription, based on Article 6(1)(f) GDPR. Our legitimate interest lies in proving lawful mailing. To permanently respect an unsubscription or objection, the email address may remain on a suppression list; it will then be used exclusively for this purpose.

Opening and click measurement

The newsletters are analyzed on a personalized basis. For this purpose, the messages may contain a small image file or tracking pixel and appropriately marked links. When accessed, technical browser and system information, the IP address, and the time of access are processed. This allows us to associate with each recipient whether and when a message was opened and which links were clicked. The analysis serves to improve our content and tailor it to the interests of our recipients.

Personalized performance measurement is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR; for access to end-device information requiring consent, Section 25 para. 1 TDDDG also applies. Acceptance of the cookie banner on the website does not replace this consent. The measurement results are assigned to the recipient profile and deleted when the profile is deleted. You can revoke your consent to performance measurement by email or unsubscribe from the newsletter via the unsubscribe link. After revocation, existing measurement profiles will be deleted unless there is an independent legal basis for limited further retention.

Brevo campaigns after a download

For email campaigns following a download, we use Brevo. The Brevo provider group includes, among others, Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany, and Sendinblue SAS, 17 rue de Salneuve, 75017 Paris, France. Your email address, information about the download you requested, and the associated registration, delivery, and usage data are processed. The campaign includes offers for thematically relevant LMHV training and a voucher.

Registration is completed via a confirmation email. By clicking the link in the email, you confirm your email address and start the download. Subsequent promotional emails are sent based on your consent pursuant to Art. 6 para. 1 lit. a GDPR in conjunction with Section 7 para. 2 no. 2 of the German Unfair Competition Act (UWG). Simply downloading the file does not constitute consent to receive additional advertising.

In Brevo campaigns, we track on a personal basis whether and when messages are opened. The above information regarding performance measurement, consent, unsubscription, deletion, and limited retention of consent records applies accordingly. You can unsubscribe at any time via the unsubscribe link or by contacting our data protection officer. For transfers to third countries within the scope of Brevo services, the published data processing terms include EU standard contractual clauses and supplementary safeguards. Further information: https://www.brevo.com/de/legal/privacypolicy/ and https://www.brevo.com/de/legal/termsofuse/.

11 Google Analytics and Google Tag Manager

Google Analytics 4

We use Google Analytics 4 for the statistical analysis of website usage. This includes processing page views, interactions and events, timestamps, referring websites, and technical browser and device information. Cookies or similar identifiers may be used to associate usage data with a specific browser or device. This analysis helps us improve the content and usability of our online services.

The analysis requiring consent is based on Article 6(1)(a) GDPR and, in the case of end-device access requiring consent, on Section 25(1) TDDDG. Recipients are the Google companies responsible for the service, in particular Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and, where applicable, Google LLC, USA. For international transfers, the applicable Google Privacy Policy, including the Data Privacy Framework and/or EU Standard Contractual Clauses, applies. Further information: https://policies.google.com/privacy and https://policies.google.com/privacy/frameworks?hl=de.

For data retention in Google Analytics 4, event data is set to 2 months and user data to 14 months. The option to reset on new user activity is enabled: The retention period for user data restarts with each new activity. This can extend the actual retention time with repeated use. After the respective period expires, data is automatically deleted as part of Google Analytics' monthly deletion cycle. These data retention settings do not apply to standard aggregated reports. You can withdraw your consent at any time with effect for the future and request the deletion of your personal data in accordance with legal requirements.

Google Tag Manager

We use Google Tag Manager for the centralized integration and management of website tags. This establishes a connection to Google; technically necessary connection data, in particular the IP address, may be processed. The analytics and advertising services integrated via the Tag Manager also process the data described in their respective sections. The Tag Manager does not replace the required consent for these services.

The integration of Google Analytics and advertising services, which require consent, is based on Article 6(1)(a) GDPR, and for end-device access requiring consent, on Section 25(1) TDDDG. The above information regarding Google and international data transfers applies. Further information: https://support.google.com/tagmanager/answer/9323295.

12 Google Ads and Microsoft Advertising

We use Google Conversion Tracking and Microsoft Universal Event Tracking (UET) to measure the success of our ads. This may involve processing information about ad interactions, pages visited, technical browser and device data, IP addresses, cookie or click identifiers, and the recorded conversion events. We do not transmit email addresses or phone numbers to Google or Microsoft for enhanced conversion tracking.

The performance measurement, which requires consent, is based on Art. 6 para. 1 lit. a GDPR and, insofar as information is stored on or read from your device, § 25 para. 1 TDDDG.

Google Ads is provided for the EEA by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The contractual partner for Microsoft Advertising with a business address in Germany is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. Recipients may also include affiliated companies and technical service providers. US recipients may include Google LLC and Microsoft Corporation. Google documents its Data Privacy Framework and EU Standard Contractual Clauses for international transfers. Microsoft also documents its DPF participation and Standard Contractual Clauses; however, the applicable legal basis for Microsoft Advertising and the specific transfer remains decisive. Data protection information: https://policies.google.com/privacy and https://privacy.microsoft.com/de-de/privacystatement. You can revoke your consent in accordance with the instructions in section 5.

13 YouTube and podcast links

We embed YouTube videos using enhanced privacy mode. The embedding is blocked via Borlabs until you approve it. Only after you approve it will the necessary connections for the player be established. In this process, your IP address, technical device information, and details about your video access may be transmitted to Google and/or YouTube. Enhanced privacy mode does not guarantee anonymous or completely data-free use.

The service provider for users in the EEA is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The legal basis for this processing is your consent pursuant to Art. 6 para. 1 lit. a GDPR and, in the case of access to end devices requiring consent, Section 25 para. 1 TDDDG (German Telemedia Act). When processed by Google, data may be transferred, in particular to Google LLC in the USA. Google documents this in accordance with the Data Privacy Framework and EU Standard Contractual Clauses, subject to the applicable terms and conditions. Further information: https://policies.google.com/privacy/frameworks?hl=de. Data protection information: https://policies.google.com/privacy. The options for cancellation are described in section 5.

We provide standard external links to Spotify and Apple Podcasts; podcast players are not embedded. Simply displaying these links does not load a podcast player on our end. Clicking a link will take you away from our website. The privacy policies of the respective platforms apply to data processing on those platforms. https://www.spotify.com/de/legal/privacy-policy/ and https://www.apple.com/legal/privacy/de-ww/.

14 Translation of e-learning content

For the multilingual provision of our website and training courses, we use TranslatePress with integrated Google Translate. Only general texts and labels are transmitted to the Google Translate interface. Names, individual test results, and other personal learning content are not transferred for translation. The generated translations are stored in our WordPress database and used for further access.

Information on data protection at Google: https://policies.google.com/privacy.

15 online training courses with Zoom

We use Zoom for online training sessions and meetings. Depending on the participation method, the following data is processed: name, email address, meeting ID, technical connection and device data, as well as audio, video, chat, and screen content that you share. This data is used for the organization and execution of the respective event.

For our own contractual services, Article 6 Paragraph 1 Letter b GDPR applies; for participation in company bookings and the necessary communication, Article 6 Paragraph 1 Letter f GDPR applies. Our legitimate interest lies in conducting the booked training and ensuring appropriate communication. The provider is Zoom Communications, Inc., USA. Zoom documents its participation in the Data Privacy Framework and the use of EU Standard Contractual Clauses for international transfers, particularly with regard to other recipients, insofar as no applicable adequacy decision applies. Further information: https://www.zoom.com/en/trust/gdpr/.

We do not record Zoom training sessions and do not use automatic transcripts or AI summaries. Privacy information: https://www.zoom.com/de/trust/privacy/.

16 Maintenance, test environments, migration and backups

Our contracted IT service providers may access the website and its data to the extent necessary for maintenance, troubleshooting, migration, and recovery. Isolated test environments and backups may be created to test changes. These may contain customer, order, and learning account data, unless the content has been previously removed or anonymized.

WP STAGING and Migrate Guru were used for technical work. The use of these tools serves the purpose of creating and transferring website copies and does not constitute an independent advertising or analysis tool. Hosting, technical support, and the associated recipients are described in Section 4.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the functionality, security, and recoverability of the website. Test copies are only required for the respective maintenance or testing task. Backup copies serve to restore data in case of loss and are replaced as part of the backup cycle. If data is to be deleted in the production system, an older backup must not lead to the regular use of that data again; during a restore, the relevant deletions must be taken into account.

17 comments and spam protection

To prevent unwanted automated submissions, we use Antispam Bee. If you use the provided comment fields, we process the content you enter, your name or display name, contact details, and the technical information required for verification. This processing serves the purpose of moderation, publication, and prevention of misuse, based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in providing usable, spam-protected input functions.

Gravatar queries, as well as country and language filters, are disabled in the current configuration. Comments marked as spam are deleted after 60 days; certain entries identified as spam are immediately discarded. Approved comments are retained for the duration of their publication. You can contact our data protection officer to have your own posts deleted; legal obligations and legitimate interests in providing evidence remain unaffected.

18 Storage duration and deletion

Access to the booked course is valid for 12 months from the booking date. Certificates, learning progress, and test results are deleted together 24 months after the booking date. Invoices and other legally required business documents are subject to their respective statutory retention periods.

We only store personal data for as long as the respective purpose exists or as long as legal obligations or legitimate interests in proof and defense require further storage. If the legal basis ceases to exist, the data is deleted or effectively anonymized. For data that must be retained for a limited period, its use is restricted to the remaining purpose.

Statutory retention periods depend on the type of document. According to Section 147 of the German Fiscal Code (AO), accounting records must generally be kept for eight years, certain books and financial statements for ten years, and other documents subject to retention requirements for six years. The start of the retention period and any possible extensions are governed by law. These periods do not apply uniformly to all learning, tracking, and contact data.

Inquiries and appointment details are deleted after processing is complete, unless a further business relationship or permissible obligation to provide evidence requires retention. For data stored in Zoho, retention periods depend on the specific transaction: contract and invoice documents according to legal requirements, ongoing customer data according to the duration of its necessary use, survey data after completion and evaluation of the survey, and documents according to their associated business purpose. Newsletter and measurement profiles are deleted after revocation or termination of the subscription; required consent forms and blocklists are exempt from this to the extent described. Technical logs, test copies, and backups are retained for their respective security and recovery purposes and are deleted when their purpose ceases to exist or replaced by the backup cycle.

19 social media presences and Loom

We maintain company profiles on Facebook, Instagram, LinkedIn, and Xing. We use these profiles to present our services and to communicate with interested parties. Facebook and Instagram are provided within the EEA by Meta Platforms Ireland Limited. LinkedIn Ireland Unlimited Company is specifically responsible for LinkedIn, and XING SE & Co. KG is responsible for Xing, according to its current privacy policy. These providers also process usage data for their own purposes and may provide us with aggregated statistics about our profiles. Our processing of inquiries and interactions is based on Article 6(1)(f) GDPR; our legitimate interest is the communication and presentation of our company. Further information: https://www.facebook.com/privacy/policy/, https://privacycenter.instagram.com/policy/, https://www.linkedin.com/legal/privacy-policy and https://privacy.xing.com/de/datenschutzerklaerung.

For Facebook and Instagram page statistics, there is joint responsibility with Meta for the collection and transmission of the underlying usage data pursuant to Article 26 GDPR. The agreement is available at https://www.facebook.com/legal/terms/page_controller_addendum Accessible. The corresponding agreement applies to LinkedIn page statistics. https://legal.linkedin.com/pages-joint-controller-addendum. The platform providers conduct further analysis and provide us with statistics. You can assert your data subject rights against us and the respective platform providers. We use Zoho Social to manage our posts and the associated interactions.

We may provide links to videos on Loom as needed. Loom players are not embedded in our website or learning platform. Clicking on a Loom link will take you to an external website; the privacy policy of the respective provider applies there.

20 Your rights

Subject to the legal requirements, you have the right to information under Article 15 GDPR, rectification under Article 16, erasure under Article 17, restriction of processing under Article 18, and data portability under Article 20 GDPR. You can withdraw your consent at any time with effect for the future, without affecting the lawfulness of processing before the withdrawal.

You can contact our data protection officers and lodge a complaint with a data protection supervisory authority, in particular at your usual place of residence, workplace, or the location of a suspected infringement. For our registered office, the State Commissioner for Data Protection of Lower Saxony is responsible. Contact information: https://www.lfd.niedersachsen.de/.

Objection to legitimate interests and direct marketing

Where we base our data processing on Article 6(1)(f) GDPR, you may object to this processing on grounds relating to your particular situation. We will then no longer process this data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the purpose of establishing, exercising or defending legal claims.

You can object to the processing of your data for direct marketing purposes at any time without giving reasons. This also applies to any related profiling. After such an objection, we will no longer use your data for direct marketing.