Privacy Policy

This Privacy Policy explains how we process personal data. It is based on the terminology of the General Data Protection Regulation (GDPR) and takes into account the Federal Data Protection Act (BDSG) and the Telecommunications and Digital Services Data Protection Act (TDDDG). It applies to the website www.alpha-heidelberg.de, including all applications, services, and tools, regardless of the method of access, and also covers mobile devices. We may amend this policy at any time by publishing an updated version on our website. The version published there at any given time is the one that applies.

The entity responsible for data processing on this website is:

Alpha Aktiv – Private Educational Institute
Beata Drogi
Hans-Böckler-Straße 2
69115 Heidelberg

Phone: +49 (0) 6221 5880269
Email: info@alpha-heidelberg.de

The controller determines, either alone or jointly with others, the purposes and means of processing personal data (e.g., names, contact information, etc.).

Our Data Protection Officer is Jessica Reischert. You can contact her at the address listed above or by email at info@alpha-heidelberg.de.

Unless otherwise specified, the personal pronouns “we” and “us” in the following text refer to Alpha Aktiv, and the pronouns “you” and “your” refer to customers and visitors who visit our website www.alpha-heidelberg.de or use the services offered by the website or the private educational institution Alpha Aktiv.

Our website is hosted by Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4-6, 32339 Espelkamp, Germany (Mittwald). When you visit one of our pages, your browser establishes a connection to a Mittwald server. In the process, certain information about the connection is stored in so-called log files. Mittwald processes this data on our behalf. For more information, please see Mittwald’s privacy policy at www.mittwald.de/datenschutz.

The following personal data is collected because it is technically necessary to display the website to you and to ensure stability and security: IP address, date and time of the request, amount of data transferred, access status (HTTP status), and the website from which you accessed our site (referrer URL). This data is stored for 30 days and then deleted.

Storing this data in log files serves to ensure the functionality and optimization of the website, as well as the security of our IT systems. This constitutes our legitimate interest in data processing. The legal basis for the collection and temporary storage of the data is Article 6(1)(f) of the GDPR.

We have entered into a data processing agreement with Mittwald in accordance with Article 28 of the GDPR. Due to the hosting arrangement, this data is not transferred to countries outside the European Union or the European Economic Area.

Our website uses cookies. These are small text files that your web browser stores on your device. Cookies help us make our website more user-friendly, effective, and secure.

Some cookies are “session cookies.” These cookies are automatically deleted at the end of your browser session. Other cookies remain on your device until you delete them yourself. These cookies help us recognize you when you return to our website.

We use cookies and similar technologies that are strictly necessary for the operation of the website or for features you have explicitly requested based on Section 25(2)(2) of the German Telemedia Act (TDDDG) and Article 6(1)(f) of the General Data Protection Regulation (GDPR). As the operator of this website, we have a legitimate interest in ensuring the technically error-free and seamless provision of our services.

We use all other cookies and similar technologies—in particular those for analytics, marketing, and integration purposes (Google Analytics, Google Ads, YouTube)—only if you have given your prior consent (Section 25(1) of the TDDDG, Art. 6(1), sentence 1, subparagraph (a) of the GDPR). When you visit our website, we obtain your consent via our consent management tool (cmm19). In doing so, we store your selection and the time of your decision as proof (Art. 7(1) GDPR, Art. 6(1)(c) GDPR). You may revoke your consent at any time with future effect or change your selection by accessing the cookie settings on our website again. The lawfulness of the processing carried out prior to revocation remains unaffected.

With a modern web browser, you can also monitor, restrict, or prevent the setting of cookies. Many web browsers can be configured so that cookies are automatically deleted when the program is closed. Disabling cookies may result in limited functionality on our website.

For security reasons and to protect the transmission of confidential information that you send to us as the website operator, our website uses SSL or TLS encryption. This ensures that data you transmit via this website cannot be read by third parties. You can recognize an encrypted connection by the “https://” in your browser’s address bar and by the padlock icon in the browser bar.

Data submitted via the contact form, including your contact information, is sent to us by email and stored so that we can process your inquiry or be available to answer any follow-up questions. The same applies to inquiries you send us directly by email. This data will not be disclosed to third parties without your consent.

The processing of data entered into the contact form is based on your voluntary consent (Art. 6(1)(a) GDPR). If your inquiry is aimed at concluding or performing a contract, the legal basis is Article 6(1)(b) of the GDPR. You may withdraw your previously given consent at any time. To do so, simply send an informal email to info@alpha-heidelberg.de. The lawfulness of data processing operations carried out prior to the withdrawal remains unaffected by the withdrawal.

Data submitted via the contact form or by email will remain with us until you request its deletion, revoke your consent to its storage, or there is no longer a need to store the data. Mandatory legal provisions—in particular retention periods—remain unaffected. Please note that emails without additional encryption can generally be viewed by third parties during transmission.

Which services store personal data:

• when you contact us using our contact form
• when you send us an inquiry via email
• when you register online for a course, an exam, or one of our services
• when you contact us in any other way

During the registration and order fulfillment process, we store data that can personally identify you. Providing all personal data is voluntary. However, we cannot guarantee that a contract will be concluded without the provision of the necessary personal data.

What personal data is stored:

• Name, mailing address, phone number, email address, IP address, date of birth, nationality
• Payment information
• Data that we are required by law to collect or that we are authorized to collect under applicable law, for example, for customer authentication

Why personal data is collected:

• To conduct and bill for booked courses, exams, and services
• to verify the accuracy of data
• to contact customers via email, mail, or phone
• to detect, prevent, and investigate illegal activities
• to offer customers special promotions, solicit their feedback, or provide information about services in accordance with applicable law
• to monitor and improve the information security of our services

Where personal data is stored and processed, and who receives it:

• Personal data is stored and processed within the company. Only authorized personnel have access to this data. This includes management, accounting, and administration.
• If you make use of additional services, we will only disclose data to the relevant parties to the extent necessary, such as to exam providers and testing organizations (e.g., telc, TestDaF), to our health insurance partner (Care Concept AG), to housing providers and host families, to funding agencies, and to government authorities in connection with visas and registration (Art. 6(1), sentence 1, lit. b GDPR).
• Personal data is transferred to legally authorized third parties in the context of investigations, criminal prosecution, ongoing court proceedings, and for the purpose of asserting, exercising, or defending legal claims (Art. 6(1), sentence 1, lit. f GDPR). In such cases, only information relevant to the investigation is transferred.
• If you have given us your explicit consent, your data may be disclosed to third parties in accordance with Article 6(1), sentence 1, letter a of the GDPR.

When you use our cost calculator, we process the information you enter there (e.g., desired course, duration, and accommodations, as well as your contact information if you request a price quote) in order to provide you with a non-binding price quote. The legal basis is Article 6(1)(b) of the GDPR (pre-contractual measures); if you have given your consent, the legal basis is Article 6(1)(a) of the GDPR. The data will be deleted as soon as it is no longer necessary for the intended purpose and there are no retention obligations that prevent its deletion.

For online and hybrid courses, as well as online trial lessons, we use the video conferencing service [enter provider, address, and link to the privacy policy]. In particular, we process your name or display name, email address, IP address, device and connection data, as well as audio and video data, provided that you enable your camera and microphone. The legal basis is Article 6(1)(b) of the GDPR. Classes are recorded only with your prior consent. For transfers to third countries, see Section 5.

We post job openings on our website. If you apply for a position with us, we will process your application materials and contact information in order to conduct the application process (Art. 6(1), sentence 1, lit. b of the GDPR in conjunction with § 26 of the BDSG). If an employment relationship is not established, we will delete your documents no later than six months after the conclusion of the process. Longer storage, e.g., in a candidate pool, will only occur with your express consent (Art. 6(1), first sentence, lit. a GDPR).

We collaborate with our partner school, Alpha Aktiv Tunis. To the extent that data is transferred to the partner school in Tunisia for the purposes of consultation, registration, or course delivery, this occurs only if it is necessary to fulfill a contract or to take precontractual measures at your request (Art. 49(1), sentence 1, subparagraph b of the GDPR) or if you have given your explicit consent (Art. 49(1), sentence 1, subparagraph a of the GDPR). There is no adequacy decision by the European Commission for Tunisia; the level of data protection there may be lower than in the European Union.

You can contact us via WhatsApp using a link on our website. The provider for users in the European Economic Area is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. When you click the link and use WhatsApp, the provider processes data, in particular your phone number, connection data, and metadata; according to the provider, the message content is end-to-end encrypted. We process your phone number and your messages to respond to your inquiry (Art. 6(1)(b) or (f) of the GDPR). The use of WhatsApp is voluntary; you may also contact us at any time by phone or email. Data may also be transferred to the United States in this process (see Section 5). For more information, please see WhatsApp’s Privacy Policy at www.whatsapp.com/legal/privacy-policy-eea.

On our website, we provide links to our profiles on Facebook and Instagram (provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland). These are simple links, not plugins: Data is not transmitted to Meta until you click on the link. After that, Meta’s privacy policy applies. To the extent that we maintain profiles on these platforms and receive statistics, we may be jointly responsible with Meta; you can then exercise your rights with either party. The legal basis for our presence is Article 6(1)(f) of the GDPR (public relations and information about our offerings).

We use the following services only if you have given your consent via our consent management tool (cmm19) (Art. 6(1), first sentence, lit. a GDPR; § 25(1) TDDDG). You may revoke your consent at any time with future effect (see Section 2, Cookies and Consent Management).

Google Analytics

Our website uses the web analytics service Google Analytics (Google Analytics 4). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The parent company is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google Analytics uses cookies and similar technologies that enable the analysis of website usage. The information generated in this process regarding your use of our website is transmitted to a Google server and stored there. The server is typically located in the United States; the transfer is based on the safeguards described in Section 5. According to Google, IP addresses are not logged or stored in Google Analytics 4. On our behalf, Google uses this information to evaluate your use of the website, to compile reports on website activity, and to provide us with other services related to website and internet usage. As the operator of this website, we have an interest in analyzing user behavior in order to optimize our website and our advertising. User- and event-level data is automatically deleted after the retention period set in our Analytics account; this period is a maximum of 14 months.

Google Signals

We have enabled the “Google Signals” feature. This allows Google to recognize visitors who are signed in to their Google Account and have enabled personalized ads across devices. Reports can be generated that provide insights into the age, gender, and interests of site visitors. This data comes from Google’s interest-based advertising as well as from third-party visitor data. We are unable to link this data to a specific individual. You can disable this feature via the ad settings in your Google Account (https://adssettings.google.com) or by revoking your consent to data collection by Google Analytics.

Browser Add-on

You can also prevent the collection of data generated by Google Analytics regarding your website usage—including your IP address—and its processing by Google by downloading and installing the browser add-on available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de.

Data Processing on Behalf of a Third Party

To fully comply with legal data protection requirements, we have entered into a data processing agreement with Google.

Details on how Google Analytics handles user data can be found in Google’s Privacy Policy: https://support.google.com/analytics/answer/6004245?hl=de.

Google Ads (Conversion Tracking and Remarketing)

Our website uses Google Ads (formerly Google AdWords), an online advertising program provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). As part of Google Ads, we use conversion tracking and remarketing.

Conversion Tracking

When you click on an ad placed by Google, a cookie is set for conversion tracking. Cookies are small text files that your web browser stores on your device. These cookies expire after the validity period set by Google and are not used to personally identify users. The cookie allows Google and us to recognize that you clicked on an ad and were redirected to our website. Each Google Ads customer receives a different cookie; the cookies cannot be tracked across the websites of Google Ads customers. Conversion cookies are used to generate conversion statistics for customers who use conversion tracking. We learn how many users clicked on our ad and were redirected to pages with a conversion tracking tag. However, we do not receive any information that would allow us to personally identify users.

Remarketing

If you have visited our website, Google may use cookies or identifiers to display our ads to you on other websites and within services in the Google Display Network. We receive statistics for this purpose, but no information that personally identifies you.

Legal Basis and Withdrawal

Processing is based on your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). If you do not wish to participate in tracking, you can withdraw your consent via the cookie settings or disable the conversion cookie in your browser settings. In that case, you will not be included in the conversion tracking statistics. You can also disable personalized ads in the ad settings of your Google Account at adssettings.google.com. Data may be transferred to Google in the U.S. in this process (see Section 5).

For details on Google Ads and conversion tracking, please refer to Google’s Privacy Policy: https://policies.google.com/privacy?hl=de.

YouTube

Our website uses YouTube plugins to integrate and display video content. The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; the video portal is operated by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA.

The videos are not loaded until you have given your consent via our consent management tool. After that, when you visit a page with an embedded YouTube plugin, a connection is established to YouTube’s servers. This allows YouTube to determine which of our pages you have visited. If you are logged into your YouTube account, YouTube can directly associate your browsing behavior with your personal profile. You can prevent this by logging out beforehand.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you may revoke at any time with future effect. The integration serves to present our online offerings in an appealing manner. For details on how user data is handled, please refer to the Google/YouTube Privacy Policy at policies.google.com/privacy.

You may withdraw your previously given consent at any time (Art. 7(3) GDPR and Art. 21 GDPR). To withdraw your consent, simply send an informal email to office@alpha-heidelberg.de.

As a data subject, you have the right to lodge a complaint with the competent supervisory authority in the event of a data protection violation (Art. 77 GDPR). List of data protection officers: www.bfdi.bund.de

You have the right to have data that we process automatically based on your consent or in fulfillment of a contract transferred to you or to a third party (Art. 20 GDPR).

You have the right at any time, subject to applicable legal provisions, to:

• Free access to your stored personal data (Art. 15 GDPR)
• Information regarding the origin, retention period, recipients, and purpose of data processing
• Immediate rectification, completion (Art. 16 GDPR), blocking, restriction, or erasure of this data (Art. 17 and 18 GDPR)

For security reasons, our website uses SSL or TLS encryption. This ensures that data you transmit via this website cannot be read by third parties. You can recognize an encrypted connection by the “https://” address bar in your browser and the padlock icon in the browser bar.

Depending on how your data is used, the recipients of your data include, in particular, our hosting provider Mittwald (data processor), Google (Google Analytics, Google Ads, YouTube), WhatsApp, and Meta, the video conferencing service we use, as well as the entities listed in Section 3.

“Third countries” are countries outside the European Union and the Agreement on the European Economic Area where it cannot be automatically assumed that data protection standards comparable to those in the European Union are in place. Information may be transferred to recipients in third countries in connection with Google, WhatsApp, and Meta, the video conferencing service, and the partner school in Tunisia.

If the transferred information includes personal data, we ensure prior to the transfer that the recipient in the third country can guarantee the required level of data protection. For providers in the United States that are certified under the EU-U.S. Data Privacy Framework, this is based on the European Commission’s Adequacy Decision of July 10, 2023 (Art. 45 GDPR). Otherwise, we rely on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) or, in the cases mentioned in Section 3, on Art. 49 GDPR. The former EU-U.S. Privacy Shield is no longer valid and is no longer used by us as a basis for data processing. You may obtain a copy of the relevant safeguards upon request using the contact information provided above.

We process personal data:

• after obtaining consent (Art. 6(1)(a), Art. 7 of the GDPR, and § 25(1) of the TDDDG)
• to fulfill our obligations, to enter into a contract, to enable the use of our services, and to respond to inquiries. Article 6(1)(b) of the GDPR permits the processing of data for the performance of a contract or pre-contractual measures
• to fulfill our legal obligations (Art. 6(1)(c) GDPR)
• to protect vital interests (Article 6(1)(d) of the GDPR)
• to pursue our legitimate interests, provided that the interests, fundamental rights, and fundamental freedoms of the data subjects do not take precedence (Art. 6(1)(f) GDPR)
• in the job application process pursuant to Article 6(1)(b) of the GDPR in conjunction with Section 26 of the BDSG

Personal data is stored until your interest in discontinuing storage outweighs our legitimate interest in storing it. Due to retention requirements under commercial and tax law, data may also be stored even without a legitimate interest. Personal data is deleted as soon as storage is no longer necessary—that is, as soon as retention requirements have been met and further storage is no longer legally permitted. The processing of personal data stored due to a retention requirement is restricted. It may only be accessed if necessary in light of the purpose of the retention obligation. Unless a shorter period is specified in this statement, the retention period is governed by these principles.

To prevent the misuse of and unauthorized access to personal data, Alpha Aktiv implements all necessary technical and organizational security measures in accordance with Article 32 of the GDPR, taking into account implementation costs, the likelihood of incidents, and the state of the art. Access to the data is controlled. In accordance with Article 25 of the GDPR, data is protected through targeted software and hardware purchases.

The provision of personal data is not required by law or by contract, unless expressly stated otherwise. However, certain information is required to conclude and perform a contract (e.g., course registration); without it, we cannot conclude the contract. Automated decision-making, including profiling as defined in Article 22 of the GDPR, does not take place.

Withdrawal of Your Consent

Certain data processing activities are only possible with your explicit consent. You may withdraw any consent you have already provided at any time (Art. 7(3) GDPR). To withdraw your consent, simply send an informal email to info@alpha-heidelberg.de; you can also withdraw your consent to cookies and third-party services via the cookie settings. The lawfulness of the data processing carried out prior to the withdrawal remains unaffected by the withdrawal.

Right to Object (Art. 21 GDPR)

To the extent that we process your data based on legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time for reasons arising from your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims. If your data is processed for direct marketing purposes, you may object to this at any time without providing a reason. If you do not wish to receive marketing communications from us, please contact us via the email address provided above.

Right of Access, Rectification, Erasure, and Restriction

• You have the right, at any time and within the scope of applicable legal provisions, to receive information free of charge regarding your stored personal data (Art. 15 GDPR).
• You have the right to be informed about the origin of the data, the planned retention period, the recipients, and the purpose of the data processing.
• You have the right to have your data corrected and completed without delay (Art. 16 GDPR), to have it erased (Art. 17 GDPR), and to restrict the processing of your data (Art. 18 GDPR).
• In this regard, and for any further questions regarding personal data, you may contact us at any time using the contact information listed in the legal notice or by reaching out to our Data Protection Officer (see Section 1).

Right to Data Portability

You have the right to have data that we process automatically—based on your consent or in fulfillment of a contract—provided to you or to a third party. The data will be provided in a machine-readable format. If you request the direct transfer of the data to another controller, this will only take place to the extent that it is technically feasible (Art. 20 GDPR).

Right to Lodge a Complaint with the Competent Supervisory Authority

As a data subject, you have the right to lodge a complaint with a supervisory authority in the event of a data protection violation (Art. 77 GDPR). The competent authority for us is:

The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg
Lautenschlagerstraße 20
70173 Stuttgart
Phone: 0711 615541-0
Email: poststelle@lfdi.bwl.de
Website: www.baden-wuerttemberg.datenschutz.de

A list of all data protection authorities can be found at www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.

Source: Data Protection Configurator from mein-datenschutzbeauftragter.de (modified)

We use Google Analytics in conjunction with the IP anonymization feature. This ensures that Google truncates your IP address within member states of the European Union before it is transmitted to the United States.

You can prevent Google Analytics from collecting data by downloading and installing the following browser plugin: tools.google.com/dlpage/gaoptout