Privacy policy

Legal bases

We process personal data only where the law permits it. Depending on the processing, we rely on:

• Art. 6 (1) (a) GDPR — your consent, for example when you load the map on the contact page.
• Art. 6 (1) (b) GDPR — entering into or performing a contract, for example when you enquire about a course or advice.
• Art. 6 (1) (f) GDPR — our legitimate interest in the secure and stable operation of this website.

Hosting and server logs

This website is hosted with Vercel. When you open a page, the server processes technically necessary connection data: your IP address, the date and time of the request, the address requested, and the browser type and operating system your browser reports.

This processing is technically necessary in order to deliver the pages and serves secure operation. The legal basis is Art. 6 (1) (f) GDPR. We do not analyse this data in order to identify you personally and do not combine it with other data.

Cookies

This website sets no cookies for analytics or advertising. The only cookie set is called NEXT_LOCALE and stores the language you have chosen. It contains nothing but the language code and no identifier that points to you.

If you open the website without a language in the address, we read the language setting sent by your browser once, in order to take you to the right language version. You can delete the cookie in your browser at any time.

As an exception, after you sign in the Kursraum (addresses under /kursraum) sets the cookies described in the section “Kursraum for participants and teachers”. They serve the sign-in alone; there are no analytics or advertising cookies there either.

Getting in touch

If you contact us by email, telephone or messenger, we process what you tell us in order to answer your enquiry. The legal basis is Art. 6 (1) (b) GDPR where a contract is being prepared, and otherwise Art. 6 (1) (f) GDPR.

We keep your enquiry for as long as is needed to deal with it and delete it once it has been dealt with, unless statutory retention periods require otherwise.

Enrolment and advice form

When you send the enrolment and advice form, the details you entered — first and last name, email address, the level you are looking for and, if you gave them, your telephone number and message — are transmitted to our server so that we can deliver your enquiry by email to the institute's mailbox.

Delivery goes through our email provider's mail server to our own address. No third-party form or delivery service is involved. The details are not stored on this website; they then sit in our mailbox.

The handling of your enquiry follows what is described in the “Getting in touch” section.

Kursraum for participants and teachers

The Kursraum (“course room”) is a closed area of this website (addresses under /kursraum) for the institute's participants and teachers. The office sets up each account; there is no self-registration. The Kursraum's pages are not meant for search engines. While the Kursraum is switched on, the header of every page of this website shows a link to the sign-in. So that it can show “My courses” or “Administration” instead of “Sign in”, the page asks the Kursraum, once it has loaded, whether you are signed in. Like any page request, this request reaches our server with your IP address, and if you hold a Kursraum sign-in cookie it is sent along. The answer is only your role (participant, teacher or administration), or “nobody”. For visitors who are not signed in, no cookie is set and nothing is stored on their device.

What is stored for each account: first and last name, email address, role (participant, teacher or administration), whether the account is switched on, whether the person still has to choose their own password, the date the account was set up, when and from which administration account the credentials were last sent to the account by email, and the courses the person belongs to. The password is not stored in plain text but only as a hash, held by the sign-in service. At the administration's request the institute can email the temporary password to the stored address; it then appears in plain text in the message and has to be replaced by the person's own password at the first sign-in. The application stores only when this happened and from which account, not the password and not the text of the message; a copy can remain in the institute's mailbox and in the mailbox of the person who received it. For members of the administration, the language they chose for the interface (German or Turkish) is also kept in their account.

What teachers and the administration publish is stored as well: announcements, lesson entries, dates, files (for example PDF, audio, images and Office documents) and learning games. Each entry records which account created it; this is not shown to anybody.

Who sees what: participants see only the courses they are enrolled in. Teachers see and edit only the courses they are assigned to. The administration sees all accounts and courses. The database itself enforces these rules, not only the application.

Signing in with Google or Apple: participants and teachers can also sign in with a Google or an Apple account once the office has approved that account for them. The provider then learns that you are signing in to this website, and the sign-in service stores what the provider passes on (for example an identifier, an email address and a name). Google and Apple are companies based in the USA; a transfer to a third country is possible. After that, the provider's own privacy terms apply. Members of the administration sign in only with an email address and a password.

Cookies: after you sign in, your browser stores a sign-in cookie (its name is sb-…-auth-token). Scripts on the page cannot read it, it is sent only to addresses under /kursraum, it is deleted when you sign out, and otherwise it expires after 14 days without use. When you sign in with Google or Apple, your browser stores further cookies for a few minutes: those of the sign-in service for that sign-in (their names end in “-code-verifier”) and “kr-weiter”, which remembers which page you wanted to open. They are deleted once the sign-in is complete. There are no analytics or advertising cookies in the Kursraum.

Sign-in attempts: to protect against password guessing, the server remembers for a few minutes from which IP address, and for which email address (only as a hash), a sign-in failed. This is held in memory only and is not stored permanently.

Service providers: the Kursraum's data is held by Supabase (database, sign-in service and file storage) in a data centre in Frankfurt am Main. The pages are delivered by Vercel (see “Hosting and server logs”). Both process the data for us.

Deleting: the office can switch an account off or delete it at any time. Deleting removes the sign-in and the course assignments; what the person published stays, without their name. For access to, correction of or deletion of your Kursraum data, please contact the office (see “Your rights”).

Study assistant

The study assistant answers questions about courses, dates and examinations. Nothing you write is transmitted until you send a message; opening the panel only fetches the computational task described below from our server.

What you write goes to our server and from there to a language-model service that composes the reply; fal.ai is currently used for this. Your message leaves our infrastructure in the process, and a transfer to a third country is possible. Please do not write sensitive data to the assistant — for personal matters the office can be reached by telephone or email.

The conversation is held in memory only, expires by itself after a short time and is not stored permanently. The legal basis is Art. 6 (1) (f) GDPR — our interest in answering common questions immediately.

To prevent abuse and excessive cost, we limit the number of requests. To do so we evaluate technical features of the request, in particular an identifier derived from the IP address, and set your browser a small computational task. These details serve only that limit and are not combined into a profile.

Where the institute's messenger connections are active, the same assistant also answers messages you write via WhatsApp or Telegram. What is described above then applies to your message, and in addition the messenger provider concerned processes your message and your telephone number.

The map on the contact page

The contact page initially shows only a placeholder panel. The map is loaded from Google only when you click "Load map". Doing so transmits your IP address and device data to Google; a transfer to a third country is possible.

The legal basis is your consent under Art. 6 (1) (a) GDPR, which you give with that click and can withdraw with effect for the future. Without the click, nothing is sent to Google.

Fonts

All fonts are served from our own server. There is no connection to Google Fonts or any other font network, and no IP address is passed to a third party.

Features that run in your browser

Two features of this website run in your browser rather than on our server:

• The placement test runs entirely in your browser. Your answers and your result are not transmitted to us and not stored.
• The language parrot uses your browser's speech output. Which voices are available depends on your browser and operating system; some of them generate the voice not on the device but at the browser vendor, which receives the text in order to do so. Nothing is transmitted to us.

Links to other services

The website links to Google Maps, WhatsApp and Instagram. These are ordinary links: they transmit nothing until you follow them. After that, the privacy terms of the provider concerned apply, over which we have no influence.

If you write to us via WhatsApp or another messenger, that provider also processes your message and your telephone number.

Retention

We keep personal data only for as long as is necessary for the purpose concerned or as statutory retention periods require. Technical connection data arises at the host and is retained there only for a limited period; study assistant conversations expire automatically and are not archived.

Your rights

You have the following rights in respect of your personal data. To exercise them, please write to the address given above:

• Access to the data processed (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on a legitimate interest (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7 (3) GDPR)
• Complaint to a data protection supervisory authority (Art. 77 GDPR)