Your data. Your control.

The controller responsible for processing personal data within the meaning of the General Data Protection Regulation (GDPR) is:

No data protection officer has been appointed because the legal requirements for doing so are not met. For questions about data protection, please contact the address above.

Personal data is any information that can be used to identify you personally. We process it exclusively on the basis of the GDPR, the German Federal Data Protection Act (BDSG) and the Telecommunications Digital Services Data Protection Act (TDDDG).

• Article 6(1)(b) GDPR – performance of a contract (user account, course access, purchase)
• Article 6(1)(c) GDPR – legal obligations (for example tax retention requirements)
• Article 6(1)(f) GDPR – legitimate interests (secure and stable operation)
• Article 6(1)(a) GDPR – consent, where we expressly request it

The website runs on servers operated by a professional hosting provider with whom we have a data processing agreement under Article 28 GDPR. Each visit automatically involves processing technically necessary information:

• IP address, date and time of access
• Page or file requested and volume of data transferred
• Browser type, operating system (user agent) and referrer URL

Processing is based on Article 6(1)(f) GDPR to deliver the website, ensure its security and prevent abuse. Log data is deleted after no more than 30 days unless needed to investigate a specific security incident. All communication is encrypted using TLS.

We use technically necessary storage technologies that do not require consent under section 25(2)(2) TDDDG. We do not use analytics cookies. Optional video advertising is only loaded when you allow it in the cookie banner or cookie settings (link in the footer), under section 25(1) TDDDG and Article 6(1)(a) GDPR. You can change or withdraw your choice there at any time.

On your first visit, we suggest a suitable language (German, English, Turkish or Arabic). To do this, we evaluate your browser language setting and the country derived from your IP address.

Country identification takes place locally on our server using the GeoLite2 database from MaxMind, Inc. Your IP address is not transmitted to MaxMind or other third parties and is not stored for this purpose. The result is used only to suggest a language; only the language is saved in the aa_language cookie. You can change the language in the header at any time.

The legal basis is Article 6(1)(f) GDPR; our legitimate interest is to show you the website in a language you understand from the outset. Information about the GeoLite2 licence is available in our licence notices.

License notices

In selected free courses, advertisements may appear before or during videos. We use the VAST standard and the Google Interactive Media Ads SDK for this purpose. Advertising is only loaded if you have allowed “Video advertising” in the cookie settings; without consent, the courses remain available without advertising.

When an advertisement loads, the respective advertising provider, for example Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, processes your IP address, device and browser information, and cookies or identifiers, among other data. Transfers to the USA are safeguarded by the EU-US Data Privacy Framework. Privacy information is available at the link below.

policies.google.com/privacy

The legal basis is your consent (Article 6(1)(a) GDPR, section 25(1) TDDDG), which you can withdraw at any time via “Cookie settings” in the footer.

You create an account to use the courses. We process your first name, last name, email address and a password, which is stored only as a secure hash. You can optionally upload a profile picture and enable two-factor authentication (TOTP).

To protect your account, we log security-related events such as logins, password changes and active sessions with IP address and user agent (Article 6(1)(f) GDPR). You can view and end active sessions in your account at any time.

Account

The legal basis for the account is Article 6(1)(b) GDPR. You can request deletion of your account at any time; statutory retention obligations remain unaffected.

To let you continue where you left off, we store your learning progress, completed lessons, quiz results and certificates. You can delete notifications in the notification centre yourself at any time. The legal basis is Article 6(1)(b) GDPR.

You pay for paid courses and products through external payment service providers. We transmit the data required for payment (name, email, amount and order number). You enter payment details such as your card number directly with the provider; we do not receive them.

Stripe

Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. Data transfers to the USA take place on the basis of the EU-US Data Privacy Framework or standard contractual clauses. See the Stripe privacy link below.

stripe.com/de/privacy

PayPal

PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. See the PayPal privacy link below.

paypal.com/de/legalhub/privacy-full

The legal basis is Article 6(1)(b) and (c) GDPR. We retain invoice and order data for up to 10 years under section 147 AO and section 257 HGB.

We send only transactional emails, such as email address confirmations, password resets, security notices and order confirmations. Emails are sent through an email service provider (SMTP or Resend, Inc., USA) with whom we have a data processing agreement; transfers to third countries are safeguarded by the EU-US Data Privacy Framework or standard contractual clauses.

If you contact us by email, we process your information to handle your enquiry (Article 6(1)(b) or (f) GDPR).

All fonts are loaded locally from our server. No connection is made to Google Fonts or other external font providers. Course videos are delivered through our own infrastructure; advertisements are loaded only with consent (see “Video advertising”). We do not use social media plugins.

We store personal data only for as long as required for the relevant purpose. We delete account data after your account is deleted unless statutory retention periods prevent this (6 years under HGB, 10 years under AO). In that case, processing is restricted.

You have the right at any time to:

• Access your stored data (Article 15 GDPR)
• Have inaccurate data rectified (Article 16 GDPR)
• Erasure (Article 17 GDPR) and restriction of processing (Article 18 GDPR)
• Data portability (Article 20 GDPR)
• Withdraw consent with effect for the future (Article 7(3) GDPR)

To exercise your rights, simply send an email to the address below.

academy@aydin-academy.de

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Str. 22, 20459 Hamburg.

No automated decision-making, including profiling within the meaning of Article 22 GDPR, takes place.

We update this privacy notice when our services or the legal situation change. The version published here applies.