Privacy Policy

This is a translation for your convenience. Only the German version of this text is legally binding: read the German original.

Version: 12 October 2026

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (DSGVO/GDPR) is:

We have not appointed a data protection officer, as the statutory requirements for doing so are not met.

2. General principles

We process personal data only to the extent necessary to provide a functioning website and our content and services. Personal data is any information relating to an identified or identifiable natural person.

In principle, you can use this website without providing any personal data.

3. Accessing the website (server log files)

When you access our website, your browser automatically sends data to our hosting provider’s server. This data is temporarily stored in what are known as log files:

• IP address of the requesting device
• Date and time of access
• Name and URL of the file retrieved
• Amount of data transferred
• Notification of successful retrieval
• Browser type used and its version
• Operating system of the device
• Previously visited page (referrer URL)

Purpose: Establishing the connection, ensuring system security and stability, and error analysis.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free and secure operation of the website.

Storage period: The server log files are deleted as soon as they are no longer required for the purposes for which they were collected. They are stored only for a short period and solely for reasons of the server’s technical security.

4. Hosting

This website is hosted by an external service provider:

The provider processes the data listed above on our behalf. We have concluded a data processing agreement with the provider in accordance with Art. 28 GDPR.

Legal basis: Art. 6(1)(f) GDPR, legitimate interest in the professional and secure provision of our services.

4a. Withdrawal and cancellation via the website

Using the “Withdraw from the contract” and “Cancel contracts here” buttons, you can send us a declaration. In doing so, we process the information you enter into the form: name, email address, optionally address and phone number, the name of the contract, and your message.

Purpose: Processing your declaration and fulfilling our statutory obligation to confirm receipt to you, stating the date and time (§ 356a of the German Civil Code (Bürgerliches Gesetzbuch, BGB) for withdrawal, § 312k BGB for cancellation).

Legal basis: Art. 6(1)(b) GDPR, processing for the performance of a contract, and Art. 6(1)(c) GDPR, compliance with a legal obligation.

Recipients: The information is sent to us by email and additionally logged on our hosting provider’s server, so that receipt remains verifiable. It is not passed on to third parties.

Storage period: We keep the declaration and the time of receipt for as long as necessary for processing and as evidence, and beyond that within the scope of the statutory retention periods.

5. Cookies and storage on your device

This website uses no analytics or advertising technologies and, on its public pages, no cookies.

Only in the learning portal does our server set a single session cookie (“WKDPORTAL”) after you sign in. It contains only a random session number that allows the server to recognize that you are signed in – otherwise you would have to re-enter your password with every click. It is deleted when you sign out or close your browser.

“Auf diesem Gerät angemeldet bleiben” (“Stay signed in on this device”): If you leave this box ticked when signing in, your device additionally receives the cookie “WKDBLEIBEN” – a random string of characters that keeps you signed in after closing the app or after a break, without re-entering your password. For this purpose, we store on the server only a checksum of this cookie, your access ID, the address (wkd-online.com or dozent.wkd-online.com), a device name such as “Android · Chrome” and the times it was created and last used. It is valid for 90 days from its last use. Signing out (“Abmelden”) deletes the cookie and the entry; a new password ends all of these sign-ins, as does WkD at your request (e.g. if you lose your phone: “auf allen Geräten abmelden” – sign out on all devices); when your access ends, the entries are deleted. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and § 25(2) no. 2 of the German Telecommunications and Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG), respectively, because you choose this function yourself. On other people’s or shared devices, please untick the box.

For teachers only, a second cookie (“WKDGERAET”) is added if they choose “Dieses Gerät merken” (“Remember this device”) when signing in: a random string of characters by which we recognize the device, so that a sign-in code is not required every time they sign in (see section 8b, “Sign-in code for teachers”). It is valid for 90 days.

For the cart function, we store a single piece of information in your browser’s local storage (“localStorage”): which courses you have added to the cart and in what quantity. This information contains no personal data and no identifier by which you could be recognized. It does not leave your browser and is not transmitted to us.

On the checkout page, your browser also remembers the information you have already entered there (salutation, name, email address, phone number, address, chosen payment method and your message to us). This serves solely your convenience: if you go back or reload the page, you do not have to type everything again. This information also stays in your browser and is only transmitted to us when you submit your order. Your consent to the Terms and Conditions and to the right of withdrawal is deliberately not stored.

Audio player in the learning portal: So that, when listening on the go, you can continue where you left off, your browser remembers in its local storage which audio of a playlist you were on and at what point, as well as the playback speed you selected. This information does not leave your device; we do not learn what, when or for how long you listen.

Expanded lessons: If your course has many modules and lessons, you can expand and collapse them. Which ones you last had open is likewise remembered only by your browser (per course), so that you do not have to search again on your next visit. This, too, is not transmitted to us.

Legal basis: § 25(2) no. 2 TDDDG; the storage is strictly necessary for the cart, the checkout, signing in to the learning portal, the audio player you use and the course overview to function. No consent is required for this, and therefore no cookie banner either.

Storage period: The cart remains until you empty it. The information from the checkout is deleted as soon as you have submitted your order. The session cookie ends when you sign out or close your browser; the teachers’ device cookie after 90 days or with a new password. The position in the audio player is overwritten as soon as you continue listening and is removed once you have listened to a playlist to the end. Which lessons were expanded is overwritten each time you expand or collapse them. You can remove all of this yourself at any time by clearing the website data in your browser.

6. Fonts

This website uses the fonts “DM Sans” and “Manrope”. The font files are stored on our own server and loaded from there. No connection is made to Google’s servers or those of any other third party. Your IP address is not transmitted to third parties in the process.

7. Contacting us by email

If you contact us by email, your information (email address, name, content of the message) is stored in order to process your inquiry and in case of follow-up questions.

Legal basis: Art. 6(1)(b) GDPR, if the inquiry is aimed at concluding a contract; otherwise Art. 6(1)(f) GDPR on the basis of our legitimate interest in responding to inquiries.

Storage period: The data is deleted as soon as the matter has been concluded and no statutory retention obligations stand in the way.

8. Contacting us via WhatsApp

Our website contains a link to WhatsApp. A connection to WhatsApp’s servers is established only once you actively click this link. Merely visiting our page does not transmit any data to WhatsApp.

The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Your data is then processed (including a possible transfer to the USA) in accordance with WhatsApp’s terms, over which we have no influence. You can find WhatsApp’s privacy notice at whatsapp.com/legal/privacy-policy-eea.

Legal basis: Art. 6(1)(a) GDPR, your consent, which you give by actively clicking the link. If you do not want this, please contact us by email instead.

8a. Order and payment processing

When you book a course, we process the information you enter at checkout.

Data processed: salutation, first and last name, address, email address, phone number, the courses booked, the amount, the chosen payment method, your message to us, and the order and invoice number.

Purpose: conclusion and performance of the contract, payment processing, invoicing and fulfillment of our statutory tax retention obligations.

Legal basis: Art. 6(1)(b) GDPR, processing for the performance of a contract, and Art. 6(1)(c) GDPR for the statutorily required retention.

Payment service provider: We process payments through Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands. When you choose a payment method, we transmit to Mollie the order number, the amount, the individual items of your order, as well as your name, your billing address and your email address. You can find Mollie’s privacy notice at mollie.com/de/privacy.

Important for you: You do not enter your card details with us, but on Mollie’s payment page. Card number, expiry date and security code never reach our server at any time and are neither stored nor processed by us.

Further recipients depending on the payment method: If you pay via PayPal, PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg is involved. If you pay via Klarna, Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden is involved; Klarna may carry out its own credit check in order to decide on deferred payment. If you pay by card via Apple Pay or Google Pay, Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland or Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, respectively, are additionally involved. The privacy notices of the respective providers named, over which we have no influence, apply to this processing.

Storage period: We keep invoices and the related order documents for eight years; we are obliged to do so as accounting records under § 147(3) of the German Fiscal Code (Abgabenordnung, AO). The period begins at the end of the calendar year in which the invoice was issued and may be extended for as long as the tax assessment period is still running. Deletion on request is not possible within this period; in that case, the data is restricted (blocked) under Art. 18 GDPR for all other purposes and kept solely to fulfill the retention obligation.

Customer data outside these documents: For our own customer management, we keep a record on you containing contact details and internal notes on course support. This record is not subject to any statutory retention obligation. We delete it at your request at any time, but at the latest when the business relationship has ended and no claims remain outstanding. The invoices are not affected by this.

8b. The learning portal

If you take lessons with us, we will, on request, set up access for you to our learning portal at /portal.php. There you will find the materials for your course – videos, audio recordings, worksheets and links –, the dates of your lessons, and you can upload assignments and collect the corrected version.

The lessons themselves do not take place in the learning portal. The portal only shows you when they take place and a link to the service through which we hold them. More on this below under “Lesson dates and live lessons”.

Data processed: first and last name, email address (which is also your username), the level of your course, the classes (learning groups) you are enrolled in and thus your courses, the date until which your access is valid, an internal note on course support, the times of your first and your most recent sign-in, as well as all files you upload and the messages you write about them. Of your password, we store only a non-reversible hash (Argon2id); we do not know your password and cannot view it.

Purpose: delivery of the lessons booked, in particular the provision of learning materials and the correction of your assignments.

Legal basis: Art. 6(1)(b) GDPR, processing for the performance of the tuition contract.

Sign-in log: For every sign-in, every failed attempt and every upload, we store the time, your access ID and a truncated hash of your IP address. The IP address itself is not stored. This serves solely to protect against passwords being guessed by trial and error (Art. 6(1)(f) GDPR, legitimate interest in the security of access).

“Mein Fortschritt” (“My progress”) – what is counted and what is not: In the portal, under Mein Fortschritt, you see your results – grades from your teacher, exercises, the online exercise and the live quiz – as percentages in a line over time. They are derived exclusively from what you submit and answer and what your teacher corrects. For submissions and corrections, your access ID, the course, the number of the assignment and the time are stored – not your name. How the quiz results are generated and who sees them is explained below under “Quizzes and points”.

What we expressly do not record: We do not store whether, when or for how long you watch a video, listen to an audio, open a worksheet or click a link. There is no measurement of reading or viewing time. The only thing recorded is on which days you opened the learning portal – without time of day, without page, without duration (see “Internal evaluation” below). Nor do we derive anything from this: no learning profile and no prediction is created. Points are awarded only for the occasions listed below under “Quizzes and points”.

Filling in worksheets in the portal: You can fill in a worksheet (PDF) directly in the learning portal – type into built-in form fields or write freely on it. This happens in your browser; as long as you do not press “Speichern” (Save), our server learns nothing about it. If you press Speichern (Save), Herunterladen (Download) or Abgeben (Submit), the edited PDF file is transmitted to us and – like any other file of yours – stored encrypted in your record (Art. 6(1)(b) GDPR, delivery of the lessons). The intermediate version is kept there so that you can continue on another device; one version is stored per worksheet, and each save overwrites the previous one. In doing so, we do not record how long you worked on it or how often you saved it – only the time of the last save, so that it can be displayed to you.

Who sees the intermediate version: You yourself; beyond that – as with all files in your record – the owner and the teacher assigned to you. Submitting is separate from this: only by submitting is a submission created, which your teacher corrects. With “Von vorn anfangen” (“Start over”), you can delete your intermediate version yourself at any time; versions already submitted remain unaffected, as they are part of the correction. Both are deleted together with your access.

The PDF files are displayed by PDF.js, free software from the Mozilla Foundation. It runs entirely in your browser and is stored on our own server; no connection is made to Mozilla or any other third party in the process, and your worksheet leaves your browser only in the way described above.

No automated assessment of your submissions: Your submissions are not assessed automatically; they are corrected by hand by your teacher, who also awards the points for them. The only automatic check is, for quiz questions, whether you chose the answer the teacher has stored as correct – this results in a point, nothing else. No artificial intelligence is applied to your record, your submissions or your progress. No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

If we recommend AI-supported exercises to you elsewhere, these are independent offerings outside the learning portal. You use them voluntarily and for yourself; we do not transmit any data from your record to them, and what you do there does not feed into “Mein Fortschritt”.

Who sees this overview: You yourself, the owner and – only if the owner has expressly granted this right – the teacher assigned to you. The teacher sees the same figures as you and nothing beyond that; in addition, the teacher sees your points in a table alongside those of the other students assigned to them. Legal basis: Art. 6(1)(b) GDPR; the overview is part of delivering the lessons.

Deletion: If you or your teacher delete an assignment, it also disappears from this overview, together with the points for it. The overview is deleted in full together with your access.

Getting to know you in the first lesson

In the first lesson, your teacher gets to know you and enters in the Lehrerzimmer (staff room) what you tell them voluntarily: your learning goal, a planned exam, where you come from, which country you live in, your profession, your education or training, other languages and how you heard about WkD. The system assigns this information to a group (for example “health/care” or a country). We do not ask about religion, health, ethnic origin, political opinions or residence status.

Purpose: planning your lessons. The information is stored in encrypted form; it can be seen by the teachers of your classes and by the owner. Legal basis: Art. 6(1)(b) GDPR (delivery of the lessons) and Art. 6(1)(f) GDPR (legitimate interest in suitable lessons). The information is deleted together with your learning record.

“How did you hear about us?”

When you open the learning portal for the first time, we ask you once and on a voluntary basis how you heard about WkD (for example Instagram, Google or a recommendation). You can also choose “Keine Angabe” (“Prefer not to say”); after that, we will not ask again. The answer is stored encrypted in your profile and is deleted together with it. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in making our offering known).

Internal evaluation (group figures only)

The owner evaluates how WkD is used in order to improve lessons, materials and the range of courses – for example which languages and countries occur among the students, which courses are in demand, how high attendance and submission rates are, which skills are difficult or which quiz questions are often answered incorrectly. This produces only aggregated figures for groups; groups of fewer than five people are not shown individually. Only the owner sees the evaluation, it runs exclusively on our own server, and no data is transmitted to third parties or to an analytics service. No profile of you is created and no automated decisions are made about you.

Days on which you opened the learning portal: For this, we store for each day only “was there” – without time of day, without page and without duration – as well as the time of your first sign-in. After 35 days at the latest, the daily entry is deleted; all that remains is the number of active people per day, without names. This lets us see whether someone is falling behind, so that we can check in with them in good time.

Figures per teacher (such as how long corrections take) are visible only if the owner expressly switches them on, and serve solely to organize the lessons.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving the lessons and in supporting the students). You can object to this under Art. 21 GDPR (see section 11).

Anonymous statistics after the end of a course

When a class ends, one row without name, without access ID, without email address, without class and without free text is created for each participant – groups only: course and course type, month of start, weekdays and time of day, country and language group, age group, learning goal, occupational and educational group, how they heard about WkD, attendance in steps of ten, grade average, the result per skill as a range (for example “60–80 %”) and, for an address in Germany, the federal state (derived from the postcode, no city). These rows cannot be attributed to any person; they are therefore anonymous (Recital 26 GDPR) and remain even long after your data has been deleted. They are evaluated only in groups of five or more people.

Quizzes and points

The portal contains multiple-choice quiz questions: the online exercise (“Online-Übung”), which you do whenever you like, and the live quiz (“Live-Quiz”), in which the teacher asks a question during the lesson. You see immediately whether your answer was correct.

What points are awarded for: one point for each correct answer in the live quiz and in the online exercise (there only for the first attempt), as well as the points your teacher awards when correcting a homework assignment. There are no other sources; in particular, there are no points for signing in, viewing or clicking.

What is stored:

• Online exercise: your access ID, the question, the answer chosen, whether it was correct, how many times you attempted the question, and the time. If you do a question again, the old attempt is overwritten.
• Live quiz: your access ID, the question round, the answer chosen, whether it was correct, and how many seconds after the start of the question you answered. These answers are automatically deleted after 90 days.
• Points account: your access ID, what the point was awarded for (quiz question or assignment), the course, the area (for example writing or listening comprehension), the number of points and the time. Your name is not included. The points account remains in place for as long as your access exists, so that you do not lose points when the live answers are deleted.

What you see under “Mein Fortschritt”: only your own results, as percentages in a line over time – per area (“Meine Bereiche”, “My areas”) and as a daily average (“Meine Entwicklung”, “My development”). No class average and no name of any other person appear there.

Right after a live quiz – only temporarily: When a live quiz has ended, everyone who took part sees the result of that quiz on the live quiz page for one hour: their own result, the class average in that quiz and the first name of the person with the most correct answers (first place) together with their number of correct answers; in the event of a tie, everyone in the lead. After that, this display disappears; it does not appear permanently under “Mein Fortschritt” or anywhere else, and nothing additional is stored for it. Only first place is shown; there is no ranking, and nobody sees who is further behind. Last name, email address and individual answers are not visible. If fewer than three people took part, we do not show an average, because otherwise the others’ results could be worked out from it.

What the teacher sees during the live quiz: only how many people chose which answer – without names. The evaluation can therefore be shown on the shared screen during the lesson without anyone being exposed.

Who sees your points with your name: the owner and the teacher assigned to you, if that teacher has the “Mein Fortschritt” right (section 8c). Other students do not see your points – except right after a live quiz, for one hour, if you are in first place there (in that case your first name and your number of correct answers in that quiz).

Purpose and legal basis: The points show you and your teacher where you stand and are meant to motivate you to practise. They are part of the lessons (Art. 6(1)(b) GDPR). We base the temporary display of first place with first name after a live quiz on our legitimate interest in motivating lessons (Art. 6(1)(f) GDPR). You can object to this at any time: in the portal under Mein Zugang → Einstellungen (My access → Settings), you can switch off, by ticking a box, your first name appearing there in first place; alternatively, a short message to lernportal@wkd-online.com is sufficient. The others will then only see that someone is in the lead, not your name; your points continue to count. For this, only your access ID and the time are stored.

No grade, no decision: Points are not a grade, are not included in any report or certificate and do not determine whether you can continue a course.

Deletion: All your quiz answers and your points account are deleted in full together with your access.

Notifications to your device and the app

The learning portal and the Lehrerzimmer (staff room) can be installed as an app on a phone or computer: “WkD Lernportal” for students (wkd-online.com) and “WkD Dozent” for teachers (dozent.wkd-online.com). Both addresses belong to the same website on the same server of our hosting provider (section 4); no data is transmitted to any other parties. Nothing additional is stored for the apps themselves. The second address merely ensures that both apps remain separate on one device – with their own sign-in and their own notifications.

Notifications only with your permission: In the browser, you switch them on yourself under Mein Zugang → Benachrichtigungen (My access → Notifications). In the installed app, they are provided for from the outset; however, they only become active once you allow them on your device (the prompt comes from Android, Windows or iOS, respectively). We then let you know – for example when your lesson is about to start, a live quiz starts, or a message, an assignment or a correction is available (for teachers: messages, submissions, reported absences, responses to requests). You choose which types you receive, whether with sound, how long before the lesson we remind you, and quiet hours during which they arrive without sound.

What is stored: your access ID, the subscription address and two keys that your browser generates for this purpose (encrypted), a device name such as “Android · Chrome”, the time of last use and your settings. A notification sits in a queue for only a few seconds to minutes until it has been sent; so that the same reminder does not arrive twice, we keep a note for eight days that it has been sent.

News in the app: What we send you as a notification (new assignment, correction, message, etc.) also appears in the portal or Lehrerzimmer, respectively, under Neuigkeiten (News) and on the start page – even if you have not switched on notifications. For this, we store the type, title and text (encrypted), the destination in the portal, the time and whether you have already opened it. These items are deleted after 60 days, and immediately together with your access. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

Who is involved: Delivery takes place via the notification service of your browser or operating system – for Chrome and Android, Google (Firebase Cloud Messaging); for Firefox, Mozilla; for Safari and iPhone, Apple; for Windows, Microsoft where applicable. These providers may also be based in countries outside the EU. The content is end-to-end encrypted (“Web Push” standard): the service only sees that a message is going to your device, not what it contains. In any case, we only state in it that something is available – never the content of a message, a grade or the reason for an absence.

Legal basis and withdrawal: your consent (Art. 6(1)(a) GDPR), which you give in the browser and on the page. You can withdraw it at any time: switch notifications off on the Benachrichtigungen (Notifications) page (they then remain off on this device, including in the app, until you switch them back on yourself), unregister individual devices there, or revoke the permission in your browser. When you sign out of the portal, the device is also unregistered. If your class or your access ends, the subscriptions are deleted, and together with your access all settings as well.

Sign-in code for teachers

Teachers see the information and work of the students in their classes. So that a password alone is not sufficient for this, we send a teacher who signs in on a device not yet known to us a 6-digit sign-in code by email. It is valid for 10 minutes; only a hash, not the code itself, is held in the session. Anyone who chooses “Dieses Gerät merken” (“Remember this device”) receives the cookie “WKDGERAET” (section 5). For this purpose, we store on the server only a checksum of this cookie, the access ID, a device name such as “Android · Chrome” and the times of setup and last use – for a maximum of 90 days and for a maximum of ten devices. A new password invalidates all remembered devices; the entries are deleted together with the access. This does not apply to students. Legal basis: Art. 6(1)(f) GDPR in conjunction with Art. 32 GDPR (protection of the students’ data against unauthorized access); for the cookie, § 25(2) no. 2 TDDDG.

Invoices and contract in the portal

Under Mein Zugang (My access), you can view and download your invoices from WkD and, in the case of a monthly package, your contract. Which documents appear there depends solely on the customer record (section 8a) to which the owner has linked your access – not on your email address. This way, nobody sees someone else’s invoices just because an address happens to match. The documents are not copied for this purpose: the portal displays the originals from section 8a, which are stored encrypted, and only while you are signed in. The legal basis is Art. 6(1)(b) GDPR.

How your files are stored: Your record and all files you upload are stored on the server in encrypted form (AES-256-GCM). They cannot be accessed directly over the internet; every retrieval goes through your sign-in. Further details in section 12.

Where the portal’s data is stored: The information about your access and your assignments is stored in a database (MariaDB) on the same server of our hosting provider (section 4), with whom a data processing agreement under Art. 28 GDPR is in place. Name, email address, notes, file names and assignment titles are also stored there in encrypted form (AES-256-GCM); the key is not stored in the database. The uploaded files themselves continue to be stored encrypted in the file system and not in the database. No transfer to a country outside the EU takes place.

Storage period: Your access is valid until the date we have agreed with you. After that, you can still download your files for 30 days, but can no longer upload anything new. A further six months later, your access and all your files are automatically and permanently deleted. If you would like to keep files, please download them beforehand. At your request, we will delete your access earlier at any time.

What remains unaffected: Invoices and order documents from section 8a are subject to the statutory retention period and are not covered by the deletion of the portal access.

Lesson dates and live lessons

The portal shows the dates of your class, each with a link to an external conferencing service (for example Zoom, Microsoft Teams or Google Meet). The lessons themselves are held via this service, not via our website.

As soon as you click this link, you leave our service. From that moment on, the privacy policy of the respective provider applies, and data is transmitted to that provider – depending on the provider, for example your IP address, your display name, audio and video. We will inform you before the course starts which service we use; on request, we will tell you the provider and the basis for the transfer at any time.

What our portal stores of this: only the appointment itself, i.e. date, time, duration, topic and the link. We do not record whether you attended a session, how long you were there or what was said there. Our portal has no insight into the conference.

Messages in the portal

In the Nachrichten (Messages) section, you can write to your teacher, and they reply to you there. These messages run exclusively via our own server; no messenger service is involved.

What is stored: the text of your message, your name, the time and whether the other party has already read it. Text and name are stored encrypted in the database.

Who reads along: the owner and the teachers to whom you are assigned (see section 8c). Other students do not see your messages.

What goes out by email: Only a notice that something is waiting for you, together with a link to the portal. The text of your message is not included in this email.

Storage period: Messages are automatically deleted after one year, but at the latest together with your access. (A much shorter period applies to the class group – see below.) The legal basis is Art. 6(1)(b) GDPR (performance of the tuition contract).

Class group

If a class group is switched on for your class, the other participants in that class see your first name and everything you write there. That is the purpose of the group, and it cannot be restricted to individual persons.

What the others see: your first name, your text and the time. Not visible are your last name, your email address, your assignments, your submissions and your learning progress.

Voluntary: Nobody has to write in the group. Anyone who does not write anything does not appear there either. You ask a question to the teacher alone under Nachrichten (Messages).

Switching on and off: The group is off by default. Only the owner can switch it on for a class, and every such change is logged.

If something goes wrong: Every post can be reported. We review reported posts and hide them if necessary. Hidden posts are not deleted immediately, but remain visible to the owner and the teachers so that the incident remains traceable; after one year, they too are deleted.

Your rights: At your request, we will delete individual posts of yours at any time. The legal basis is Art. 6(1)(b) GDPR in conjunction with our legitimate interest in a functioning exchange within the course (Art. 6(1)(f) GDPR); you can object to this at any time, in which case we will remove you from the group.

Images, PDFs and voice messages in the class group

Attachments may additionally be enabled for a class. You can then attach an image, a PDF or a voice recording to a post – for example your completed worksheet or a spoken sentence to practise pronunciation.

What the others receive: All participants in your class see your image or PDF and hear your recording, together with your first name. That is the purpose, and it cannot be restricted to individual persons.

With a voice recording, your voice is transmitted. A voice is a particularly personal characteristic: under certain circumstances, age, origin or mood can be recognized from it. Therefore, think about what you record, and do not record anything personal. A recording is always voluntary – you can do every exercise in writing just as well, and this will not put you at any disadvantage.

Think of others, too: Please do not upload photos in which other people can be identified, and do not record anyone without their knowledge.

How we store this: Attachments are stored encrypted on our server, outside the publicly accessible area. They cannot be retrieved via an open link: with every retrieval, the portal checks again whether the requesting person is signed in and belongs to this class. A hidden post, including its attachment, can no longer be retrieved.

Limits: image or PDF up to 10 MB, voice recordings up to 10 minutes (25 MB).

Switching on and off: Attachments and voice messages are off by default and are enabled separately from each other. Only the owner can switch them on for a class, and every such change is logged.

Storage period and your rights: as with the other posts in the class group – they are automatically deleted 3 hours after the end of the class session (see below), at the latest together with your access, and at any time at your request. The legal basis is Art. 6(1)(b) GDPR in conjunction with Art. 6(1)(f) GDPR; you can object to their use at any time.

How long posts remain in the class group

The contents of the class group are automatically deleted 3 hours after the end of the class session. Please save or download important content beforehand.

What is deleted: all posts and replies in this class group, including images, PDFs and voice messages, as well as the practice tasks with their answers. The deletion is permanent; the files are also removed from the server in the process.

What is not deleted: your class, your access, your teacher, your homework and submissions, your messages, your points and your learning progress. The deletion concerns the class group exclusively.

Anything written after the deletion time remains until the end of the next class session. If no session at all is entered for a class, the posts remain until the general period of one year.

Purpose: Data minimization in accordance with Art. 5(1)(c) and (e) GDPR. What was needed for the lesson in this session is no longer required afterwards and should therefore not remain stored permanently.

Notification emails about the class group

If something has been written in your class group that you have not yet seen, we send you a short reminder to your email address at most once a day.

This email only states that something new is available, how many posts there are, and a link to the portal. It contains neither the text nor any attachment nor the name of the person who wrote it. Anyone who has written something themselves or has been in the portal since then does not receive a reminder. The legal basis is Art. 6(1)(b) GDPR (performance of the tuition contract).

Contact via WhatsApp

The learning portal may contain a button that opens WhatsApp. This button is an option, not a requirement – you can reach us just as well by email and via the Nachrichten (Messages) section, which runs on our own server.

As soon as you press this button, you leave our service. From that moment on, the privacy policy of WhatsApp Ireland Ltd. or Meta, as applicable, applies. In the process, your phone number, your WhatsApp profile name and the content of your message, among other things, are transmitted to the service and processed there. A transfer to the USA cannot be ruled out.

What we store: Your message arrives in our WhatsApp account on a mobile device; our website stores nothing of this process. The legal basis is your consent given by deliberately clicking (Art. 6(1)(a) GDPR).

If this goes too far for you, simply use the Nachrichten (Messages) section in the portal or write to lernportal@wkd-online.com. This will not put you at any disadvantage.

8c. Teachers and who sees your work

Your work is corrected by a teacher. If WkD uses employees or freelancers for this, they receive their own password-protected access to the so-called Lehrerzimmer (staff room).

Who sees what: A teacher sees only the students of the classes they teach – and nobody else. They see these students’ names, email addresses, course level, term of access as well as their assignments and files. They do not see anyone else. Which class a teacher teaches is determined solely by the owner; each class has exactly one responsible teacher.

Individually enabled: The owner grants each teacher individual rights. The “Mein Fortschritt” overview (section 8b) is a separate right and is not granted automatically: a teacher who only corrects does not see it. Even then, a teacher sees only the same as you – your results as percentages, per area and per day – and nothing about your viewing of materials. Points for a homework assignment are awarded by the teacher who corrects it; for this, they need the right to edit assignments. Every such award is recorded in the access log.

What a teacher cannot do: They cannot block or delete any access, cannot delete any of your submissions and cannot access any order, invoice or payment data. Only the owner has these capabilities. Nor can they switch a class group on or off; they can only write in it and hide individual posts.

Access log: Every opening, upload and removal of a file by a teacher is logged with the time, the teacher’s name and the file name. In addition, a truncated hash of the IP address is stored; the IP address itself is not stored. Only the owner can view the log. It is automatically deleted after twelve months.

Purpose and legal basis: The log serves the security of processing under Art. 32 GDPR and enables us to actually answer your request for access under Art. 15 GDPR. The legal basis is Art. 6(1)(c) and (f) GDPR.

Your right of access: You can ask at any time who accessed your files during a particular period. To do so, write to us at info@wkd-online.com.

Confidentiality: All persons with access are bound to confidentiality. Teachers are not processors; they act under the authority of the controller within the meaning of Art. 29 GDPR.

Teachers’ data: Of the teachers themselves, we store their name, email address, the permissions granted, the time of their last sign-in and a non-reversible hash of their password.

9. Analytics tools and advertising

We do not use any analytics, tracking or advertising services. No reach measurement, no profiling and no automated decision-making takes place.

This also applies in the learning portal. The “Mein Fortschritt” overview there shows exclusively your results from quizzes, exercises and homework and is not an analytics tool; see section 8b.

Our own internal evaluation in group figures (section 8b, “Internal evaluation” and “Anonymous statistics after the end of a course”) runs only on our server; no third-party service is used for it and no data is passed on.

10. Recipients of data

Your data is passed on to third parties only if

• you have expressly consented (Art. 6(1)(a) GDPR),
• the disclosure is necessary for the performance of a contract (Art. 6(1)(b) GDPR),
• there is a legal obligation to do so (Art. 6(1)(c) GDPR), or
• this is necessary to safeguard legitimate interests and there is no reason to assume that you have an overriding interest worthy of protection (Art. 6(1)(f) GDPR).

11. Your rights

You have the following rights vis-à-vis us with regard to your personal data:

• Access (Art. 15 GDPR): which data we process about you
• Rectification (Art. 16 GDPR): to have inaccurate data corrected
• Erasure (Art. 17 GDPR): the “right to be forgotten”
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent (Art. 7(3) GDPR): with effect for the future

Right to object under Art. 21 GDPR

To the extent that we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation.

Right to lodge a complaint with a supervisory authority

Without prejudice to any other legal remedies, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement.

The competent authority is the supervisory authority of the German federal state in which we have our registered place of business:

12. Data security

In transit: This website uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the address bar of your browser begins with “https://” and a padlock symbol is displayed. As a result, data you transmit to us cannot be read by third parties.

On our server: We store your customer data, orders, contracts, withdrawals and cancellations received, as well as the records and files in the learning portal, in encrypted form (AES-256-GCM). This also applies to the learning portal’s data in the database: name, email address, notes, file names and assignment titles are likewise stored there in encrypted form, so that even a backup copy of the database cannot be read without the key. Even someone who gained unauthorized access to the stored files could not read them without the corresponding key. The key is kept separately from the data and outside the area accessible over the internet.

Access: Only the person named in the “Controller” section can access the complete data, and only via a password-protected area. Teachers have separate access with restricted rights and see only the students assigned to them, individually or via their classes (see section 8c). The password is stored only as a non-reversible hash (Argon2id); not even we ourselves know it in plain text.

Payment data: Card number, expiry date and security code never reach our server at any time (see section 8a).

13. Changes to this privacy policy

We reserve the right to amend this privacy policy so that it always complies with current legal requirements, or to implement changes to our services, for example when introducing new offerings. The version current at the time of your next visit will then apply.