Privacy policy — Notenbrücke

Notenbrücke GmbH, Helenenstraße 88, 45143 Essen, Germany. Telephone 0201 8574 120, email info@notenbruecke.de. The same controller is responsible for all seven branches.

Our data protection officer can be reached at datenschutz@notenbruecke.de, or by post at the address above marked “Datenschutz”.

When you open our pages our hosting provider automatically processes server log data: IP address, date and time of the request, the page requested, the volume of data transferred, browser type and operating system. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is the secure and reliable operation of the website. Log data is deleted after 14 days.

We use no analytics, tracking or advertising cookies. There is no audience measurement and no profiling.

Two things are stored in your browser’s local storage rather than on our servers: the branch you have chosen, and your decision about embedded maps. Neither leaves your device and both can be deleted at any time through your browser settings. The chosen branch also appears in the address bar, so that you can share a link to your own branch.

On the contact page you can load a map from the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. No connection to that provider is made before you agree; until then we display a locally drawn graphic instead. If you load the map, your IP address is transmitted to the OpenStreetMap Foundation. The legal basis is your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time through the cookie settings in the footer.

When you submit one of our forms we process the details you enter in order to answer your enquiry. For tuition enquiries these are the name of the parent or guardian, an email address and, where given, a telephone number, the branch, the subject and school year, the child’s first name, and your free-text message.

The legal basis is your consent under Art. 6(1)(a) GDPR and, once a contract is being prepared, Art. 6(1)(b) GDPR. Enquiries that do not lead to an enrolment are deleted 90 days after our last reply. Enquiries that lead to a contract become part of the contract file and are subject to the periods set out in section 7.

Our service is addressed to parents and guardians, not to children. Children are not invited to enter their own details anywhere on this website. Every enrolment and every enquiry is completed and submitted by a parent or legal guardian.

For children under 16 the processing is based on the consent of the holder of parental responsibility under Art. 8(1) GDPR. Before the trial session we collect only the child’s first name and school year. Further details — surname, date of birth, school — are collected only on the enrolment form, which is signed by a parent or guardian.

During ongoing tuition we record, for each session, attendance, the topic covered, the homework set and the date of the next session. In the parent dashboard these entries are visible only to the parent or guardian named on the enrolment form. We collect no location data, no device data, no photographs or video recordings, and no behaviour or personality assessments. Nothing is passed to the child’s school except on the express written instruction of the parent or guardian.

Teaching records are deleted twelve months after the end of the contract. You may ask us to delete the whole record sooner at any time; tuition can continue afterwards.

To perform the tuition contract we process the name and address of the parent or guardian, bank details for the SEPA direct debit, the child’s name and school year, and the services booked. The legal basis is Art. 6(1)(b) GDPR.

Invoices and accounting records are retained for ten years under § 147 AO and § 257 HGB. The legal basis for that further retention is Art. 6(1)(c) GDPR.

We pass on data only as far as operations require: to our hosting provider, to our tax adviser, and to the bank that handles the direct debit. Contracts under Art. 28 GDPR are in place with our processors. No data is transferred to countries outside the European Union. We do not sell data and we do not use it for third-party advertising.

When a student transfers between Notenbrücke branches, the teaching record and contract data are handed to the new branch. The controller remains the same company; no transfer to a third party takes place.

We publish quotes from parents only with separate written consent and only in the form the person concerned has approved. Consent can be withdrawn at any time with future effect; we then remove the quote at the next update of the site, and within 14 days at the latest.

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), and to object to processing based on legitimate interests (Art. 21 GDPR). Consent you have given can be withdrawn at any time with future effect.

An informal message to datenschutz@notenbruecke.de is enough. We reply within one month.

You may lodge a complaint with a data protection supervisory authority. The authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

This website is served exclusively over an encrypted HTTPS connection. Access to the parent dashboard is password-protected and personal. Paper records are kept in lockable cabinets at the branches.

This is a translation provided for convenience. In the event of any discrepancy the German version of this privacy policy prevails.