Privacy Policy

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws as well as other data protection provisions is:

2.1 Scope of Processing of Personal Data

We generally process personal data of our users only to the extent necessary to provide a functional website as well as our content and services. The processing of our users' personal data regularly takes place only with the user's consent. An exception applies in cases where obtaining prior consent is not possible for factual reasons and the processing of the data is permitted by legal provisions.

2.2 Legal Basis for Processing

Insofar as we obtain the consent of the data subject for processing operations of personal data, Art. 6(1)(a) GDPR serves as the legal basis.

For the processing of personal data required for the performance of a contract to which the data subject is a party, Art. 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations required to carry out pre-contractual measures.

Insofar as processing of personal data is necessary to comply with a legal obligation to which our company is subject, Art. 6(1)(c) GDPR serves as the legal basis.

If processing is necessary to protect a legitimate interest of our company or a third party, and if the interests, fundamental rights, and freedoms of the data subject do not override that interest, Art. 6(1)(f) GDPR serves as the legal basis for the processing.

2.3 Data Erasure and Storage Duration

The personal data of the data subject will be erased or blocked as soon as the purpose of storage no longer applies. Storage may also occur if provided for by European or national legislators in EU regulations, laws, or other provisions to which the controller is subject. Data will also be blocked or erased when a storage period prescribed by the aforementioned standards expires, unless further storage is necessary for the conclusion or performance of a contract.

In the course of our business activities, we process the following categories of personal data:

• Contact data: name, email address, phone number, address
• Professional data: job title (physician/dentist), specialty, licensing status
• Education data: academic degrees, place of study, year of graduation
• Course data: registrations, participation confirmations, exam dates, progress
• Communication data: message content from contact forms, email correspondence
• Technical data: IP address, browser type, operating system, access times
• Payment data: for paid services, payment information (via payment service provider)

We process your personal data for the following purposes:

• Providing and operating our website and digital learning platform
• Processing course registrations and managing participant data
• Organizing and conducting exam preparation courses for the specialist language examination (FSP)
• Advising and supporting physicians and dentists in their professional qualification
• Communicating with prospects and participants
• Sending information about booked courses and relevant updates
• Processing payment transactions
• Fulfilling statutory retention obligations
• Improving our services and website functionality

5.1 Description and Scope of Data Processing

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer. The following data is collected:

• Information about the browser type and version used
• The user's operating system
• The user's IP address
• Date and time of access
• Websites from which the user's system reaches our website
• Websites accessed by the user's system through our website

5.2 Legal Basis

The legal basis for the temporary storage of data and log files is Art. 6(1)(f) GDPR.

5.3 Purpose of Data Processing

The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer. For this, the user's IP address must remain stored for the duration of the session. Storage in log files is done to ensure the functionality of the website. In addition, the data helps us optimize the website and ensure the security of our information technology systems. The data is not evaluated for marketing purposes in this context.

5.4 Storage Duration

Data is erased as soon as it is no longer required to achieve the purpose for which it was collected. In the case of data collected for providing the website, this is the case when the respective session has ended. In the case of data stored in log files, this is the case after seven days at the latest.

Our website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel is certified under the EU-US Data Privacy Framework and thereby ensures an adequate level of data protection in accordance with Art. 45 GDPR.

We use Neon Inc. as our database service provider for data storage. Neon operates servers within the European Union and is subject to GDPR provisions.

We have concluded corresponding data processing agreements in accordance with Art. 28 GDPR with all data processors.

7.1 Description and Scope of Data Processing

Our website features a contact form that can be used for electronic contact. If a user makes use of this option, the data entered in the input form will be transmitted to us and stored. This data includes:

• Name
• Email address
• Phone number (optional)
• Job title (physician/dentist)
• Message content

At the time the message is sent, the following data is also stored: the user's IP address as well as the date and time of contact.

7.2 Legal Basis

The legal basis for processing the data is Art. 6(1)(a) GDPR if the user's consent has been obtained. The legal basis for processing data transmitted in the course of an inquiry about our services is Art. 6(1)(b) GDPR. If the email contact aims at the conclusion of a contract, the additional legal basis for processing is Art. 6(1)(b) GDPR.

7.3 Purpose of Data Processing

The processing of personal data from the input form serves solely to handle the contact request. The other personal data processed during the sending process serve to prevent misuse of the contact form and to ensure the security of our information technology systems.

7.4 Storage Duration

Data is erased as soon as it is no longer required to achieve the purpose for which it was collected. For personal data from the contact form's input form and data sent by email, this is the case when the respective conversation with the user has ended. The conversation is deemed ended when the circumstances indicate that the matter in question has been conclusively resolved. The additional personal data collected during the sending process is erased after a period of seven days at the latest.

8.1 Description and Scope of Data Processing

When registering for our courses to prepare for the specialist language examination (FSP), we collect the following data:

• Full name
• Email address
• Phone number
• Address
• Job title (physician or dentist)
• Specialty and qualifications
• Desired exam date
• Selected course package
• Payment information

8.2 Legal Basis

This data is processed on the basis of Art. 6(1)(b) GDPR to perform a contract or to carry out pre-contractual measures.

8.3 Purpose of Data Processing

The data is processed for:

• Processing the course registration
• Organizing and planning course dates
• Providing learning materials and access to the digital learning platform
• Communication regarding the course and exam preparation
• Billing of course fees

8.4 Storage Duration

Contract data is stored after termination of the contractual relationship for the duration of the statutory retention periods (generally 10 years under commercial and tax law provisions). After these periods expire, the data is erased, provided no other retention grounds exist.

9.1 Description and Scope of Data Processing

Our website uses cookies. Cookies are text files that are stored in or by the internet browser on the user's computer system. We distinguish between:

• Technically necessary cookies: These cookies are absolutely necessary for the operation of the website and enable basic functions such as page navigation, access to secure areas, and session management.
• Analytics cookies (optional): With your consent, we use cookies that help us understand how visitors interact with our website in order to improve our offering.

9.2 Legal Basis

The legal basis for the use of technically necessary cookies is Art. 6(1)(f) GDPR (legitimate interest in providing a functional website). For all other cookies, the legal basis is your consent under Art. 6(1)(a) GDPR, which you can give via our cookie consent banner.

9.3 Objection and Withdrawal

You may withdraw your consent at any time with effect for the future. You can set your browser so that you are informed about the setting of cookies and can allow cookies only in individual cases, exclude the acceptance of cookies for certain cases or generally, and activate the automatic deletion of cookies when closing the browser.

For processing payments, we use the payment service provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. When making a payment, your payment data (e.g., credit card data) is transmitted directly to Stripe and processed there.

Stripe is certified under the EU-US Data Privacy Framework. Stripe's privacy policy can be found at: https://stripe.com/de/privacy

The legal basis for the transmission of data is Art. 6(1)(b) GDPR (performance of contract).

As part of our data processing, data may be transmitted to recipients in third countries (outside the European Union or the European Economic Area). This only occurs if:

• an adequacy decision by the EU Commission exists for the country in question (Art. 45 GDPR),
• appropriate safeguards are in place, e.g., EU Standard Contractual Clauses (Art. 46 GDPR), or
• the recipient is certified under the EU-US Data Privacy Framework.

Our service providers (Vercel, Stripe) are certified under the EU-US Data Privacy Framework and thereby ensure an adequate level of data protection.

As a data subject, you have the following rights with respect to personal data concerning you:

12.1 Right to Information (Art. 15 GDPR)

You have the right to request confirmation as to whether personal data concerning you is being processed. If this is the case, you have a right to information about this personal data and the information listed in detail in Art. 15 GDPR.

12.2 Right to Rectification (Art. 16 GDPR)

You have the right to demand the immediate rectification of inaccurate personal data concerning you and, if applicable, the completion of incomplete data.

12.3 Right to Erasure (Art. 17 GDPR)

You have the right to demand the immediate erasure of personal data concerning you, provided one of the reasons listed in detail in Art. 17 GDPR applies.

12.4 Right to Restriction of Processing (Art. 18 GDPR)

You have the right to demand the restriction of processing if one of the conditions listed in Art. 18 GDPR is met.

12.5 Right to Data Portability (Art. 20 GDPR)

You have the right to receive the personal data concerning you that you have provided to us in a structured, common, and machine-readable format. You also have the right to transmit this data to another controller without hindrance from us.

12.6 Right to Withdraw Consent (Art. 7(3) GDPR)

You have the right to withdraw consent you have once given at any time with effect for the future. The lawfulness of the processing carried out until withdrawal remains unaffected.

12.7 Right to Object (Art. 21 GDPR)

You have the right, for reasons arising from your particular situation, to object at any time to the processing of personal data concerning you carried out on the basis of Art. 6(1)(e) or (f) GDPR. We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms.

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of personal data concerning you violates the GDPR.

As our company is registered in Estonia, the competent supervisory authority is:

However, you may also contact the supervisory authority of your place of residence or workplace, e.g., in Germany the state data protection officer responsible for your federal state.

We employ technical and organizational security measures to protect your personal data against accidental or intentional manipulation, loss, destruction, or access by unauthorized persons. Our security measures are continuously improved in line with technological developments.

Our measures include in particular:

• Encryption of data transmission using SSL/TLS technology
• Access control and authentication systems
• Regular security updates and system maintenance
• Access restrictions for employees on a need-to-know basis
• Regular backups and data security

We do not use automated decision-making, including profiling, within the meaning of Art. 22(1) and (4) GDPR, which has legal effect on you or similarly significantly affects you.

We reserve the right to adapt this privacy policy so that it always complies with current legal requirements or to implement changes to our services in the privacy policy, e.g., when introducing new services. The new privacy policy will then apply to your next visit.

We recommend that you read this privacy policy regularly to stay informed about the protection of the personal data we collect.