Privacy policy

The person responsible for data processing on this website and in connection with our services is:

Phonem Sprachschule

Owner Sabrina Alibasic

Georgstraße 11

30159 Hannover

Germany

Email: info@phonem-sprachschule.de

Telephone: +49 177 318 97 21

We process personal data exclusively within the framework of the applicable data protection regulations, in particular the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG). Personal data is all information relating to an identified or identifiable natural person.

We process your data primarily to provide our website, respond to inquiries, organize and conduct language courses, manage examinations and certificates, issue certificates and invoices, process language visa-related procedures, enable our communication with participants, and offer our services securely, economically, and legally.

When you access our website, our hosting service provider processes the technically necessary data so that the website can be delivered to your end device. In particular, IP address, date and time of access, accessed content, browser type, operating system, referrer URL, and server log data are processed.

The processing takes place, insofar as it is necessary for the technical provision and security of the website, on the basis of Art. 6 Para. 1 lit. f GDPR. Our legitimate interest lies in the secure, stable, and abuse-free provision of our online offer. Insofar as the processing is necessary for the fulfillment of a contract or for the implementation of pre-contractual measures, Art. 6 Para. 1 lit. b GDPR is an additional legal basis.

Server log data is generally only stored for as long as is necessary for security purposes and troubleshooting. Backups can be kept for a limited period for technical reasons.

If you contact us by email, telephone, via a contact form, as part of a trial lesson request, via messenger services, or in another way, we process the data you provide to answer your inquiry and process the respective procedure. This may include, in particular, name, contact details, language level, desired course, appointment requests, message content, and communication history.

The processing takes place depending on the content of your inquiry on the basis of Art. 6 Para. 1 lit. b GDPR for the implementation of pre-contractual measures or on the basis of Art. 6 Para. 1 lit. f GDPR. Our legitimate interest lies in orderly communication and customer care.

In the case of online registration for our courses, we process in particular first name, last name, email address, telephone number, date of birth, address, postal code, city, if applicable country, selected courses, payment status, declarations and confirmations, as well as other information that you provide as part of the registration. We use this data in particular to process the registration, for course administration, for the creation of registration confirmations, invoices, attendance certificates, and certificates, as well as for communication in connection with your course.

The processing takes place on the basis of Art. 6 Para. 1 lit. b GDPR. Insofar as legal storage or evidence obligations exist, further processing takes place on the basis of Art. 6 Para. 1 lit. c GDPR.

If an online registration is not continued without timely payment, registration data can be deleted or blocked after the reservation period has expired in accordance with our organizational processes, provided that no legal storage obligations prevent this.

If you use our placement test, we process your test inputs, your test result, and the contact details you enter to determine your language level, display the result to you, and send it to you by email if you wish. If a specific course consultation or later registration follows from the test result, the data can be taken over into further procedure processing.

The processing takes place on the basis of Art. 6 Para. 1 lit. b GDPR, insofar as the test serves the initiation of a contract, otherwise on the basis of Art. 6 Para. 1 lit. a GDPR, insofar as you voluntarily provide us with your contact details for sending the results.

In the context of the delivery of our language courses, we process the data required for organization and implementation. This includes, in particular, master data, contact details, course bookings, attendance and participation data, performance and examination data, communication data, payment information, course-related documents, and organizational notes.

The processing takes place on the basis of Art. 6 Para. 1 lit. b GDPR. Insofar as special organizational or legal obligations exist, the processing takes place additionally on the basis of Art. 6 Para. 1 lit. c GDPR or Art. 6 Para. 1 lit. f GDPR. Our legitimate interest lies in orderly course organization, fraud prevention, claim security, and verifiability.

Insofar as lessons take place online for organizational or extraordinary reasons, the participant and communication data required for this are also processed within the framework of the video conferencing or teaching system used.

If you participate in examinations or receive a certificate, we process the data necessary for this, in particular your name, course and examination reference, examination results, date of issue, certificate number, as well as the verification data required for checking authenticity. Insofar as we issue digital certificates with a QR code or a comparable verification function, this serves to protect against forgery and the verifiability of authenticity.

The processing takes place on the basis of Art. 6 Para. 1 lit. b GDPR and, insofar as proof and defense against abuse are concerned, on the basis of Art. 6 Para. 1 lit. f GDPR. Our legitimate interest lies in the secure issuance and verification of participation and performance records.

We generally store verification data for certificates only for as long as the certificate check is offered or proof interests require this.

Insofar as you book courses in connection with a language visa or receive invitation letters, certificates, or other visa-related documents from us, we process the data required for this. This may include, in particular, identity and contact details, course booking data, payment data, passport or ID data, documents for the embassy or foreigners' registration office, participation and status data, as well as the associated correspondence.

The processing takes place on the basis of Art. 6 Para. 1 lit. b GDPR as well as, insofar as legal obligations, official requirements, or demonstrable legitimate interests exist, on the basis of Art. 6 Para. 1 lit. c and lit. f GDPR.

Insofar as this is necessary for the processing, issuance, confirmation, checking, or tracking of corresponding documents, data can be transmitted to competent embassies, diplomatic missions, foreigners' registration offices, or other competent bodies.

For the organizational support of participants, we can process email addresses as well as, insofar as used or provided by you, messenger contact details, in particular for course information, organizational notices, learning materials, photos of board images, and messages about lessons. If messenger groups are used, please note that other group members can perceive your profile data and messages visible there. We have only limited influence on the data processing by the respective provider of the messenger service.

The processing takes place on the basis of Art. 6 Para. 1 lit. b GDPR for contract execution and on the basis of Art. 6 Para. 1 lit. a GDPR, insofar as the respective form of communication is chosen voluntarily or group communication takes place via messenger.

Insofar as lessons, consultations, or meetings are conducted online, we process the data required for this, in particular names, contact details, meeting metadata, contents of chat messages, audio and video data, as well as, if applicable, shared files and screen shares. Depending on the organization of the respective appointment, services from Microsoft 365, in particular Microsoft Teams, or other video conferencing services named in the invitation may be used.

The processing takes place on the basis of Art. 6 Para. 1 lit. b GDPR. Insofar as consents are required, for example in the case of voluntarily activated cameras or recordings, the processing takes place additionally on the basis of Art. 6 Para. 1 lit. a GDPR.

Conversation or lesson recordings do not take place by default. Insofar as a recording is planned in an individual case, we will inform you separately in advance about the purpose, legal basis, and storage period.

Insofar as we use an AI-assisted telephone or voice assistant, conversation and metadata can be processed as part of incoming or outgoing communication. This may include, in particular, telephone number, times, conversation content, transcripts, recognized requests, forwarding information, and, if applicable, audio recordings. The processing serves for call acceptance, appointment and information organization, pre-qualification of requests, quality assurance, and fast accessibility.

The processing takes place on the basis of Art. 6 Para. 1 lit. b GDPR, insofar as it serves the initiation or implementation of a contract, otherwise on the basis of Art. 6 Para. 1 lit. f GDPR. Our legitimate interest lies in efficient, structured, and timely communication. Insofar as a recording or further evaluation of a conversation takes place, this only occurs with an existing separate legal basis, in particular a consent if this is required.

Insofar as AI services from OpenAI or ElevenLabs are used for this, we limit the processing to the data required for this. Recordings and transcripts are generally only stored for as long as is necessary for the respective purpose, usually only for a short time.

On our website, you can optionally use the DuBini AI chatbot to ask questions about courses, contact, registration, and general procedures. Use is voluntary. You can reach us at any time by email or telephone.

If you use the chatbot, we process the content you enter and the technical data required for this to answer your inquiry and improve the quality of our offer. Please do not enter any particularly sensitive data, for example health data, ID or passport data, full payment data, or passwords.

The processing can take place on the server side via technical service providers, in particular an AI provider for text processing as well as, if configured, an n8n or RAG infrastructure for knowledge queries on course and contract information. We limit the transmission to what is necessary for the respective inquiry.

The legal basis is Art. 6 Para. 1 lit. b GDPR, insofar as your inquiry serves the initiation or implementation of a contract, otherwise Art. 6 Para. 1 lit. f GDPR. Our legitimate interest lies in fast, understandable, and secure online consultation.

Processed data is only kept for as long as is necessary for support, security, quality assurance, and legal obligations.

You have the rights under the GDPR, in particular information, correction, deletion, restriction of processing, objection, and data portability. To do this, contact info@phonem-sprachschule.de.

Insofar as we take or publish photos or videos of participants, events, or teaching situations, this only takes place on the basis of a suitable legal basis. As a rule, this is your consent according to Art. 6 Para. 1 lit. a GDPR. You can revoke a given consent at any time with effect for the future. The lawfulness of the processing carried out until the revocation remains unaffected by this.

If image or video material is published on our social media profiles or other online presences, it should be noted that additional data processing by the platform operators can take place there.

Insofar as video surveillance is used in our premises or at entrances, this takes place exclusively to safeguard the house rights, for the safety of persons, to secure property, and to clarify specific incidents. In doing so, we process image data as well as the date, time, and location of the recording.

The processing takes place on the basis of Art. 6 Para. 1 lit. f GDPR in conjunction with Section 4 BDSG, insofar as publicly accessible areas are affected. Our legitimate interest lies in the security of our premises and the defense against or clarification of criminal offenses and comparable incidents.

Insofar as no longer storage is required to clarify a specific incident, the recordings are generally deleted within 48 hours.

For invoicing, accounting, payment processing, and fulfillment of tax and commercial law obligations, we process in particular master data, contract data, invoice data, payment data, and document information. The processing takes place on the basis of Art. 6 Para. 1 lit. b and lit. c GDPR.

We store documents relevant to tax and accounting for the duration of the respective applicable legal retention periods.

Our website can use technically necessary cookies or comparable technologies that are necessary for the secure and proper provision of the website. Optionally, additional analysis, marketing, or comfort functions can be used. Such optional technologies are only used if you have previously consented to the respective category, insofar as consent is legally required.

You can revoke or adjust a given consent at any time with effect for the future via the corresponding settings on the website.

Insofar as we use analysis and marketing services such as Google Analytics, Google Ads, Meta Pixel, or TikTok Pixel, these services process in particular online identifiers, device information, usage data, interaction data, shortened or full IP addresses, page views, event data, and similar information. This serves to measure reach, evaluate campaigns, measure conversions, optimize advertising, and the economic evaluation of our online offer.

In these cases, the processing takes place regularly on the basis of your consent according to Art. 6 Para. 1 lit. a GDPR as well as, insofar as information is stored or read on your end device, on the basis of Section 25 TDDDG. You can revoke your consent at any time with effect for the future.

We can use services from Google, in particular Google Search Console, Google Analytics, Google Ads, Google Maps, Google Places functions, route links, YouTube embeddings, or comparable Google services. Personal data can be transmitted to Google, in particular usage data, device information, online identifiers, IP addresses, location reference, or content data, insofar as you use or activate a corresponding function.

Insofar as fonts are provided via a local integration, no separate connection to Google servers takes place solely because of the fonts. Insofar as an external function from Google is activated on individual pages, the data processing described there in each case applies.

We maintain online presences on social networks and platforms, in particular on Facebook, Instagram, TikTok, YouTube, or comparable services. If you visit our profiles or communicate with us there, we process the data you transmit in the process, for example username, message content, reactions, and publicly visible profile information. In addition, the platform operators process personal data on their own responsibility. This can also take place outside the European Union.

Our processing takes place on the basis of Art. 6 Para. 1 lit. f GDPR. Our legitimate interest lies in the external presentation of our company, the communication with interested parties and participants, as well as reach analysis.

Please note that for the actual use of the platform, the data protection provisions of the respective platform operator also apply.

We transmit personal data only insofar as this is legally permissible. Recipients can be, in particular, hosting and infrastructure service providers, email and office service providers, accounting and administration service providers, video conferencing service providers, AI service providers, payment service providers, messenger and communication providers, authorities, banks, as well as other technical service providers that we use within the framework of order processing or on the basis of our own responsibility.

Insofar as this actually takes place, service providers from the areas of hosting, Microsoft 365, accounting, OpenAI, ElevenLabs, Google, Meta, TikTok, WhatsApp, as well as the providers used for individual functions can be involved.

Insofar as we use services from providers based in third countries or with a third-country reference, a transfer of personal data to countries outside the European Union or the European Economic Area can take place. Such transfers only take place if the legal requirements for this are met. These include, in particular, an adequacy decision by the European Commission, standard contractual clauses, or other suitable guarantees.

We store personal data only for as long as is necessary for the respective purposes. We then delete the data, unless legal storage obligations, proof interests, or legitimate reasons for further storage exist.

We generally store contact details and inquiries only for as long as is necessary to process and document the procedure. We store contract and course data for the duration of the contractual relationship and beyond only insofar as legal obligations or proof interests require this. We store tax-relevant documents for the respective applicable legal periods. We store certificate and verification data only for as long as the proof function is offered or legitimate interests require this. We generally delete data from video surveillance within 48 hours, unless a specific incident requires a longer backup. Data from optional analysis and marketing services depends on your consent, the technical runtime of the technologies used, and the respective deletion or anonymization settings.

You have the right, in accordance with the legal provisions, to information about the data stored about your person, to correction of incorrect data, to deletion, to restriction of processing, to data portability, and to object to certain processing.

Insofar as the processing is based on your consent, you can revoke this at any time with effect for the future. The lawfulness of the processing carried out until the revocation remains unaffected by this.

Insofar as we process your data on the basis of Art. 6 Para. 1 lit. f GDPR, you have the right to object to this processing at any time for reasons arising from your particular situation. If we process personal data for direct marketing, you have the right to object to the processing for the purpose of such advertising at any time.

You have the right to complain to a data protection supervisory authority. The authority responsible for our company is generally:

Der Landesbeauftragte für den Datenschutz Niedersachsen

Prinzenstraße 5

30159 Hannover

Germany

Telephone: 0511 120 4500

Email: poststelle@lfd.niedersachsen.de

No exclusively automated decision-making in the sense of Art. 22 GDPR, which has legal effect on you or significantly affects you in a similar way, takes place.

We reserve the right to adapt this privacy policy if our website, our services, the services used, or the legal situation change. The version published on this website at any time applies.

Status: May 2026