Privacy Policy

Privacy Policy

This privacy policy informs you, in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), about the personal data we process when you use our website and learning platform germansociallab.com, book courses or take part in live online seminars, the purposes for which we do so, and the rights you have. Personal data means any information relating to an identified or identifiable person.

1. Controller

The controller responsible for data processing within the meaning of Article 4(7) GDPR is:

Fatih Açık – GermanSocialLab
Rheinallee 12
67061 Ludwigshafen am Rhein
Germany
Phone: +49 176 82418304
Email: info@germansociallab.com

We are not required to appoint a data protection officer under section 38 of the German Federal Data Protection Act (BDSG). For any questions about data protection, please contact us using the details above.

2. Overview: legal bases

We process personal data only where there is a legal basis for doing so. The following legal bases are particularly relevant:

• Article 6(1)(a) GDPR – your consent,
• Article 6(1)(b) GDPR – performance of a contract with you, or steps taken at your request before entering into a contract,
• Article 6(1)(c) GDPR – compliance with legal obligations (for example, retention requirements under tax law),
• Article 6(1)(f) GDPR – legitimate interests, which we specify in each section below.

In addition, section 25 of the German Telecommunications and Digital Services Data Protection Act (TDDDG) applies to storing information on your device and accessing information stored there.

3. Hosting and server log files

Our website and learning platform are hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. IONOS processes the data on our behalf; we have concluded a data processing agreement with IONOS under Article 28 GDPR. Further information (in German): www.ionos.de/datenschutzerklaerung.

Each time you visit our website, your browser automatically sends data to the server for technical reasons, and this data is stored in log files (server log files): IP address, date and time of access, page or file requested, amount of data transferred, status code, referrer URL, browser and operating system used. This processing serves to deliver the website and to keep it stable and secure (for example, to fend off attacks). It is based on our legitimate interest under Article 6(1)(f) GDPR. The log files are created and stored by IONOS as our processor. According to IONOS, the log data is kept for a maximum of eight weeks and then deleted automatically. We do not evaluate the log files ourselves or store them separately; they are not combined with other data sources.

The connection to our website is encrypted using TLS (https).

Short links and anonymous counting

For short addresses such as germansociallab.com/8a, we count how often a short link was opened per day and through which channel (for example YouTube, Pinterest or newsletter – identified by a link parameter or by the referring website). We store only the date, the short link, the channel and the target page as a total. Neither your IP address nor browser data nor the full referring address is stored for this purpose, no cookies are set and no user profiles are created. The legal basis is our legitimate interest in measuring how effective our content is (Article 6(1)(f) GDPR).

Anonymous audience measurement

When you open a page, your browser uses a small script to send our server the page you opened, the domain of the website you visited before (for example google.com) and whether you are logged in. From this, we store only daily totals: number of page views and visits, pages viewed, source channel (for example "Google" or "Pinterest") and device class (smartphone, tablet or computer, derived from the browser identifier, which is not stored). IP addresses, browser identifiers and full referring addresses are not stored for this purpose, no cookies are set, no information is placed on your device and no user profiles are created. It is not possible to link the data to individual persons. The legal basis is our legitimate interest in improving our services (Article 6(1)(f) GDPR).

4. Cookies

We do not use cookies for analytics, advertising or marketing purposes, and we do not embed content from third-party providers (for example video platforms, map services or fonts from external providers) in our pages. For this reason, we do not ask for consent via a cookie banner.

• MoodleSession: a technically necessary session cookie of the learning platform. It allows you to log in and to move around within your account, and it is deleted when you close your browser or when the session expires. Legal basis: section 25(2) no. 2 TDDDG, Article 6(1)(b) and (f) GDPR.
• MOODLEID1_: set only if you actively choose "Remember username" on the login page. It stores your username for your next login. Legal basis: your consent, given by ticking the box (section 25(1) TDDDG, Article 6(1)(a) GDPR). You can delete this cookie in your browser at any time.

5. User account and use of the learning platform

5.1 Registration. To use self-study courses, you create a user account. In doing so, we process your first name, surname, email address, username, password (stored in encrypted form) and any optional profile information you choose to provide. You will receive an email to confirm your account. The legal basis is Article 6(1)(b) GDPR. When registering, you may also tell us, on a voluntary basis, how you heard about GermanSocialLab. We evaluate this information only in aggregated form in order to improve the ways we reach people; the legal basis is your consent (Article 6(1)(a) GDPR). You can change or delete this information in your profile at any time.

5.2 Course use. While you use the platform, we process data about your enrolments, your progress through the modules (for example sections marked as completed), voluntary self-reflection tasks and the times of your activities. We need this data to provide the course to you, to show your progress and, once you have worked through all modules, to issue your confirmation of participation (Article 6(1)(b) GDPR). The confirmation of participation contains your name, the course title, the scope and the date.

5.3 Logs. The learning platform logs access and activities (for example logins and course pages opened) with the time and IP address. We use these logs to keep the platform secure (for example to detect abusive login attempts), to fix errors and to provide course features (Article 6(1)(b) and (f) GDPR). The logs are deleted automatically after 365 days. Internal statistical evaluations by the learning platform take place exclusively on our server; no data is passed on to third parties in the process.

5.4 Guest access. You can view course descriptions and free content as a guest without an account. In this case, only the session cookie (section 4) is used; access is logged as described in 5.3.

5.5 Team access for organisations. If an organisation books team access, we process the contact details of its contact person and of the participants named by the organisation in order to perform the contract with the organisation (Article 6(1)(b) GDPR or, for the participants, Article 6(1)(f) GDPR, based on our legitimate interest in performing the team contract). We pass on information about your course use to the organisation only where this has been agreed with you or with the organisation, or where another legal basis exists.

5.6 Deleting your account. You can ask us to delete your account at any time – by email or via the data privacy function in your profile. Data that we must retain for legal reasons (section 11) will be restricted until the retention period ends and deleted afterwards.

6. Booking and payment (Stripe)

To process payments for annual access, team access and live online seminars, we use the payment service Stripe. For merchants in the EU, the contracting party is Stripe Payments Europe, Limited (Ireland). When you make a payment, you are redirected to a Stripe payment page, or Stripe processes the payment data directly. In particular, Stripe processes your name, email address, billing address, payment method and transaction data, and technical data (for example IP address and device information). We do not receive your payment method data (for example your full card number).

The legal basis is Article 6(1)(b) GDPR (performance of a contract) and Article 6(1)(c) GDPR where legal obligations apply (for example the prevention of money laundering). Stripe processes data partly as our processor and partly as an independent controller (in particular for fraud prevention and to meet its own legal obligations). In this context, data may also be transferred to Stripe, Inc. in the USA. Stripe is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission under Article 45 GDPR); in addition, the European Commission's standard contractual clauses (Article 46(2)(c) GDPR) are used. Further information: stripe.com/privacy.

For processing purposes, Stripe informs us that the payment has been received and provides the data we need for invoicing and accounting.

7. Live online seminars and video calls (video conferencing)

We hold our live online seminars and online conference days using one of the following video conferencing services. The email with the access link that you receive after booking tells you which service is used for a particular date. We hold advisory and initial conversations by video via Senfcall, including appointments booked through Calendly (section 8).

Senfcall (BigBlueButton) at public.senfcall.de: the operator is Computerwerk Darmstadt e.V., Hochschulstraße 1, 64289 Darmstadt, Germany. The servers are located in Germany. You can take part in your browser without a user account. The operator's own privacy notice also applies to its processing: senfcall.de/gdpr (in German).

Jitsi Meet at meet.ffmuc.net: the operator is Freie Netze München e.V., Parkstraße 28, 82131 Gauting, Germany. You can take part in your browser without a user account. The operator's own privacy notice also applies to its processing: ffmuc.net/privacy (in German).

When you take part, we process in particular your IP address, technical connection data, the display name you choose and – if you use your camera, microphone or the chat – image, sound and chat content. You decide yourself whether to switch on your camera and microphone and which name to use. We do not record seminars or conversations. The legal basis is Article 6(1)(b) GDPR (holding the seminar you have booked or a conversation that prepares a contract), and otherwise Article 6(1)(f) GDPR (legitimate interest in holding conversations you have asked for).

8. Contacting us and enquiries

If you contact us by email, telephone or via an enquiry form on the learning platform (for example for quotes, invoices or trial access for organisations), we process the information you provide (for example name, organisation, email address, telephone number and the content of your enquiry) in order to answer your enquiry. The legal basis is Article 6(1)(b) GDPR where your enquiry relates to a contract, and otherwise Article 6(1)(f) GDPR (legitimate interest in answering enquiries). We delete the data once your enquiry has been fully dealt with and no statutory retention obligations apply.

Emails are received and sent via the servers of IONOS SE (section 3). We also send system messages of the learning platform (for example account confirmation or password reset) this way.

Enquiry forms for trial access and partner enquiries

If you use our forms to request trial access for your organisation or to enquire about working together (a German-language form for trial access and an English-language form for organisations and partners), we process the data you provide (name of the organisation, your name, email address, country, optionally telephone number and message, team size, field of work or subject of your enquiry) in order to handle your enquiry and, where applicable, to set up the trial access (Article 6(1)(b) GDPR). The information is stored on our server at IONOS and forwarded to us by email. It is deleted no later than six months after receipt unless a contractual relationship results from it; statutory retention obligations remain unaffected.

Appointments (Calendly)

On our German-language pages, you can use a link to book appointments for a conversation through the Calendly service. The provider is Calendly LLC, 115 E Main St, Ste A1B, Buford, GA 30518, USA. Calendly is only linked on our pages, not embedded; data is transmitted only when you open the link. When you book, Calendly and we process your name, email address, the time you choose, any information you provide voluntarily in the booking form and technical data (for example your IP address). We use Calendly's free plan. Calendly acts as our processor; the data processing agreement (Article 28 GDPR) forms part of Calendly's terms of use. The data is processed in the USA. According to its own information, Calendly LLC is certified under the EU-U.S. Data Privacy Framework (Article 45 GDPR); should this framework cease to apply, the European Commission's standard contractual clauses have been agreed (Article 46(2)(c) GDPR). The legal basis is Article 6(1)(b) GDPR where the conversation prepares a contract, and otherwise Article 6(1)(f) GDPR (legitimate interest in holding conversations you have asked for). We delete the appointment data once your request has been fully dealt with and no statutory retention obligations apply.

We hold the booked conversation as a video call via Senfcall (section 7).

Use of an AI assistant

We use the AI assistant Claude to help us handle email enquiries, bookings and appointments and with internal administrative tasks. The provider is Anthropic Ireland, Limited (Ireland). In this context, your name, email address, the content of your message and booking, payment receipt and appointment data in particular may be processed; the assistant does not receive full payment method data (for example card numbers). The assistant prepares drafts and overviews; we send replies and take decisions ourselves. We use a plan for individuals, for which Anthropic does not offer a data processing agreement. Anthropic therefore processes the data as an independent controller in accordance with its privacy policy (anthropic.com/legal/privacy) and, according to its own information, also transfers it to the USA; for this, Anthropic relies on the European Commission's standard contractual clauses (Article 46(2)(c) GDPR). We have opted out of the use of our inputs for training AI models in the settings. The legal basis is our legitimate interest in handling enquiries and administrative tasks promptly and carefully (Article 6(1)(f) GDPR).

9. Social networks

Links to our profiles

Our pages contain links to our profiles on Facebook, Instagram, TikTok, LinkedIn and YouTube. These are simple links; no data is transmitted to these networks when you visit our website. Only when you click a link are you taken to the page of the provider concerned, where its own privacy terms apply.

Our pages on Facebook and Instagram

Facebook and Instagram are provided by Meta Platforms Ireland Limited, Serpentine Avenue, Block J, Dublin 4, Ireland ("Meta"). If you comment on our posts there or send us a message, we process your profile name, the content of your comment or message and the time, in order to reply to you. The legal basis is Article 6(1)(b) GDPR where you are asking about our services, and otherwise Article 6(1)(f) GDPR; our legitimate interest is communicating with interested people through our pages.

Page Insights

Meta provides us with aggregated statistics on the use of our Facebook page ("Page Insights"). We are joint controllers with Meta for this processing (Article 26 GDPR). The legal basis is our legitimate interest in analysing the reach of our page and improving our posts (Article 6(1)(f) GDPR). Under the agreement with Meta ("Page Insights Controller Addendum", facebook.com/legal/terms/page_controller_addendum), Meta takes on the fulfilment of the GDPR obligations for this data, in particular responding to requests from data subjects. You may, however, also exercise your rights against us (Article 26(3) GDPR); we will then forward your request to Meta. We have no influence on cookies and other technologies that Meta uses on your device; Meta obtains any consent required for these itself. Meta explains which data it processes at facebook.com/privacy/policy.

Storage period

Comments and messages remain stored by Meta until you or we delete them. We delete messages as soon as they are no longer needed to deal with your request and no retention obligation applies (section 11).

10. Recipients and transfers to third countries

Depending on the activity, the recipients of your data are our hosting and email provider IONOS (sections 3 and 8), the payment service Stripe (section 6), the operator of the video conferencing service (section 7), Calendly for appointments (section 8), Anthropic as the provider of our AI assistant (section 8) and Meta for comments and messages on our Facebook and Instagram pages (section 9). Beyond this, we pass on data only where we are legally required to do so (for example to tax authorities) or where you have consented. Data may be transferred to countries outside the EU or the EEA, in particular to the USA, in the course of payment processing by Stripe (section 6), when you book an appointment via Calendly (section 8), when we use the AI assistant (section 8) and by Meta when you use our Facebook and Instagram pages (section 9); the safeguards concerned are stated in those sections. Meta also processes data in the USA; according to its own information, Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework, for which an adequacy decision of the European Commission exists (Article 45 GDPR).

11. Storage period

We store personal data only for as long as is necessary for the purpose concerned. We store account data until your account is deleted. We delete learning platform logs after 365 days and server log files after a maximum of eight weeks (according to IONOS, section 3). Under section 147 of the German Fiscal Code (Abgabenordnung), we keep invoices and accounting records for eight years and business letters and comparable documents for six years; the period starts at the end of the calendar year. During this time, the data is restricted and not used for any other purpose.

12. Your rights

Under the GDPR, you have the following rights against us:

• access to the data we hold about you (Article 15 GDPR),
• rectification of inaccurate data (Article 16 GDPR),
• erasure (Article 17 GDPR),
• restriction of processing (Article 18 GDPR),
• data portability (Article 20 GDPR),
• withdrawal of any consent you have given, with effect for the future (Article 7(3) GDPR).

To exercise your rights, an informal message to the contact details given in section 1 is sufficient.

Right to lodge a complaint: you have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR). The authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate), Hintere Bleiche 34, 55116 Mainz, Germany, www.datenschutz.rlp.de.

13. Obligation to provide data; no automated decision-making

You are under no statutory or contractual obligation to provide your data. However, without the information required for an account, a booking or a seminar, we cannot conclude or perform the contract concerned. No automated decision-making, including profiling, within the meaning of Article 22 GDPR takes place.

14. Changes

We will update this privacy policy if our services or the legal situation change. The version published here applies.

Last updated: 1 November 2026