Privacy Policy

1. Controller

The controller within the meaning of data protection laws, in particular the EU General Data Protection Regulation (GDPR), is:

German-American Cross-Cultural Business Training
Daniel Donahey
Keßlerplatz 13
90489 Nuremberg
Germany

2. Data Subject Rights

Under the contact details provided above, you may exercise the following rights at any time in accordance with the GDPR:

access to your personal data processed by us (Art. 15 GDPR)
rectification of inaccurate or incomplete personal data (Art. 16 GDPR)
erasure of your personal data stored by us (Art. 17 GDPR)
restriction of processing (Art. 18 GDPR)
objection to processing (Art. 21 GDPR)
data portability, where the legal requirements are met (Art. 20 GDPR)
withdrawal of consent at any time with effect for the future, where processing is based on consent

You also have the right to lodge a complaint with a supervisory authority.

3. General Information on Data Processing

We process personal data only to the extent necessary to provide a functional website, our online course services, our protected member area, and related communication.

Personal data is disclosed to service providers only to the extent necessary for the technical operation, security, backup, communication, and provision of our website and services.

4. Hosting, Server Log Files, and Email Infrastructure

Our website is hosted by ALL-INKL. ALL-INKL also provides the domain-related infrastructure, email mailboxes, and mail server services used for this website.

When you access our website, information of a general nature is automatically collected in server log files. This may include, in particular:

browser type and browser version
operating system
referrer URL
accessed pages/files
date and time of access
IP address
internet service provider
other similar technical access data

This data is processed for the following purposes:

ensuring a stable and secure operation of the website
ensuring proper display and functionality
detecting, preventing, and investigating misuse or security incidents
technical administration of the hosting environment

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable, and technically correct provision of our website.

Log file data is stored for as long as required for the above purposes and is then deleted, unless longer retention is necessary for the investigation of a specific security incident or to fulfill legal obligations.

5. Contacting Us

If you contact us via the contact form, the data entered by you will be processed for the purpose of handling your request and communicating with you.

The contact form currently processes the following data:

full name
email address
message

The legal basis is Art. 6(1)(f) GDPR, as we have a legitimate interest in efficient communication with users and prospective customers. If your request relates to the initiation or performance of a contract, the legal basis is Art. 6(1)(b) GDPR.

Contact requests are deleted no later than 12 months after final processing of the request, unless statutory retention obligations apply or further storage is necessary due to a contractual relationship or a legitimate legal interest.

6. Google reCAPTCHA

We use Google reCAPTCHA v3 to protect our contact form against spam, abuse, and automated submissions.

reCAPTCHA is only loaded after you have given your consent via our consent tool. If you do not provide consent, the contact form cannot be used.

Depending on the implementation and your interaction, personal data and technical data may be transmitted to Google, including in particular:

IP address
browser and device information
referrer information
interaction data
security-related analysis data
cookies, including _GRECAPTCHA

The legal basis for the use of reCAPTCHA is your consent pursuant to Art. 6(1)(a) GDPR.

The use of reCAPTCHA may involve the transfer of personal data to countries outside the EU/EEA.

7. Registration and User Account

Users may create a user account on our website in order to access protected course content and related account functions.

When registering, we currently process the following data:

first name
last name
email address
password

Users set their password themselves during registration and may later change their password and other account information within their account area.

Upon registration, a membership or access authorization is assigned so that protected content can be made available to the user.

The legal basis for the processing of registration and account data is Art. 6(1)(b) GDPR, as the processing is necessary to provide the requested user account and the associated services.

User account data is stored until deletion is requested by the user or the account is no longer needed for providing the service, unless legal obligations or overriding legitimate interests require longer retention.

Users cannot currently delete their accounts themselves and must contact us if they want their account removed.

8. Protected Content, Course Participation, Quiz Results, Learning Progress, and Certificates

We provide protected course content through the user account and membership system. In this context, we may process data necessary to provide the course and document participation.

This may include in particular:

membership or access status
assigned subscriptions
course access information
quiz-related data
learning progress data
certificate-related data

The legal basis is Art. 6(1)(b) GDPR, as this processing is necessary to provide the digital course services requested by the user.

Quiz, learning, and certificate-related data is stored as long as the user account exists, unless legal obligations or overriding legitimate interests require longer retention.

9. Transactional and System Emails

We use MailPoet for the sending of system-related and transactional emails. This currently includes, in particular:

registration confirmations
password reset emails
account-related emails
contact form notifications
potentially, in the future, quiz- and certificate-related emails

MailPoet is not currently used by us for newsletter marketing.

The legal basis for the sending of transactional and system emails is Art. 6(1)(b) GDPR where the emails are necessary to provide the user account or course service, and Art. 6(1)(f) GDPR where there is a legitimate interest in secure and reliable communication regarding the website and user account.

10. Embedded Videos via Bunny Stream

We embed videos on our website using Bunny Stream via iframe. These videos are used both on publicly accessible pages and within protected member areas.

The videos are loaded only after the user has given consent via our consent tool. Before consent is granted, the content is blocked by a content blocker.

When the video is loaded, personal data and technical information may be transmitted to Bunny and related delivery domains, including in particular:

IP address
browser and device information
access time
referrer information
technical connection data

We use Bunny Stream solely as a video hosting and delivery service and do not currently use it for our own analytics or tracking setup.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.

According to our current setup, Bunny content may be delivered using infrastructure in multiple regions, including Frankfurt, London, New York, and São Paulo. This may involve transfers of personal data to countries outside the EU/EEA.

11. Cookies and Consent Management

We use the consent management tool “Real Cookie Banner” to manage cookies, similar technologies, embedded services, and the related consents. Details on how “Real Cookie Banner” works can be found here:
https://devowl.io/rcb/data-processing/

Real Cookie Banner is used in particular to:

obtain and document user consent
block external services until consent is granted
enable users to manage previously granted consents

The legal basis for the processing of personal data in connection with consent management is Art. 6(1)(c) GDPR insofar as consent documentation is legally required, and Art. 6(1)(f) GDPR insofar as there is a legitimate interest in a legally compliant and technically reliable consent management process.

Our website may use technically necessary cookies that are required for the operation, security, consent documentation, and, where applicable, for WordPress-related functions.

In addition, the following consent-based services are currently used:

Google reCAPTCHA
Bunny Stream

You can change your privacy settings at any time here:
<a href=”#consent-change”>Change privacy settings</a>

You can view your consent history here:
<a href=”#consent-history”>Privacy settings history</a>

You can revoke your consent here:
<a href=”#consent-revoke”>Revoke consent</a>

12. Backups and Data Security

We use UpdraftPlus to create regular backups of our website as a security measure and for disaster recovery purposes.

Backups are currently created once per day as full backups and stored in a private Google Drive account. These backups may contain personal data processed through the website, including in particular user account data and other website data required to restore the website.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in ensuring the security, integrity, recoverability, and continuity of our website and services.

Backups are stored for 30 days and then deleted or overwritten, unless longer retention is necessary in an individual case for security or legal reasons.

13. Recipients and Processors

In connection with the operation of our website and services, personal data may be disclosed to the following categories of recipients, insofar as necessary:

hosting and email infrastructure providers
website and membership system providers
contact form and anti-spam providers
video hosting and delivery providers
consent management providers
backup and cloud storage providers

This currently includes, in particular:

ALL-INKL for hosting, domain-related infrastructure, and email services
Google for reCAPTCHA and Google Drive backup storage
Bunny for embedded video delivery
devowl / Real Cookie Banner for consent management functionality
MailPoet for transactional email sending
UpdraftPlus for website backup management

14. International Data Transfers

Some of the services we use may involve the transfer of personal data to countries outside the European Union or the European Economic Area, in particular when using Google services and Bunny Stream, or when storing backups in Google Drive.

Where such transfers take place, they are carried out only insofar as this is necessary for the provision, security, and operation of our website and services, or on the basis of your consent where required.

15. Storage Periods

Unless a more specific retention period is stated in this Privacy Policy:

contact requests are stored for up to 12 months after final processing
backups are stored for 30 days
user account data is stored until deletion is requested or the account is no longer needed for providing the service
quiz, learning, and certificate data is stored as long as the user account exists
log data is stored only as long as necessary for technical and security purposes

Longer retention may occur where required by law or where necessary for the establishment, exercise, or defense of legal claims.

16. Right to Object Under Art. 21 GDPR

Where we process personal data on the basis of Art. 6(1)(f) GDPR, you have the right to object, on grounds relating to your particular situation, at any time to such processing.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or unless the processing serves the establishment, exercise, or defense of legal claims.

17. Changes to This Privacy Policy

We reserve the right to amend this Privacy Policy so that it always complies with current legal requirements and reflects changes to our website or services. The current version published on this website shall apply.

18. Questions About Data Protection

If you have any questions about data protection, please contact the controller named above.