Privacy policy of the learning platform

1. Who is responsible?

The controller for the processing of your personal data within the meaning of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) is:

Lernsfera Academy, Inhaberin: Irina Quent, Am Dichtlacker 9, 94529 Aicha vorm Wald, Deutschland

E-mail: welcome@lernsfera.com · Phone: +49 176 30194794

We have not appointed a data protection officer because we are not required to under Art. 37 GDPR and § 38 BDSG. You can reach us with any privacy question at the e-mail address above.

2. Which data we process

Depending on which functions you use, we process:

• Account data: first and last name, e-mail address, phone number, interface language. We do not store your password, only an irreversible check value (hash).
• Details from the registration form: desired course and exam if any, language level, desired start, possible lesson times, notes on your working hours, your wishes and your preferred way of contact.
• The link to our client through whom you take part: the company that pays for your course, or the private person who booked it (which may be you).
• Details of your invitation: which invitation link or invitation e-mail brought you to us, when the link was opened, when you confirmed your e-mail address and when you registered (details in section 3).
• Usage log: sign-ins and sign-outs, pages of the platform you visited and how long you stayed, changes to your details and settings with the previous and the new value (details in section 3).
• Security data: signed-in devices (browser identifier), failed sign-in attempts, changes of password and two-factor sign-in. With two-factor sign-in, also an encrypted key and recovery codes (only as check values). We store your IP address encrypted together with the sign-in and the entries of the usage log, plus a check value.
• Learning results: placement and practice tests with result, duration and number of attempts.
• If you do not agree with the result of a placement test and write to us about it: your message, together with that test result.
• Notifications on the platform (the bell): what we told you about, when, and whether you have read it. You can clear this history yourself at any time; it is deleted with your account.
• Lessons: your group, your timetable, your attendance (when you entered and left the online room and how long you were there), submitted homework with files, your teacher's feedback and – only for lessons announced as such – recordings and transcripts (details in section 4).
• E-mails we exchange with you and the automatic notifications we send you.
• Payments, if you pay yourself: amount, course, status and time. We do not receive your card or account details.
• Your consents and confirmations with the document version and time.

3. How you come to us and how you use the platform

An account can only be created through an invitation. There are two ways: an invitation link that our client – for example your employer – passes on to its staff, or a personal invitation e-mail that is valid only for your address. With the general link you first enter your e-mail address; we send you a six-digit code that you enter on the same page, and only then can you register. The e-mail names neither the client nor the course. This ensures that nobody uses someone else's address.

• About the invitation we record: which link or invitation was used, when an invitation e-mail was sent to you, how often and when the link was opened, how often a confirmation e-mail was requested, whether and when you confirmed your address, failed registration attempts with their reason (for example a password that is too weak – not the password itself) and the time of your registration. Openings of a general link without an e-mail address being entered are only counted, without being linked to a person.
• In the usage log we record: sign-ins with time, IP address and device (browser and operating system), start, end and length of each session, failed sign-ins, sign-outs, the pages of the platform you open with time and duration, the start and end of tests, opening lesson rooms, recordings and materials, and every change to your details, your password, your two-factor sign-in, your consents and your language – including changes made by our staff, with their name.
• For showing “online” or “away” in the back office: the time of your last click on the platform, noted at most once a minute. Offline means that no session is open any more.
• We do not record: passwords, security codes, your individual answers in tests, content you type into forms before saving it, and your activities outside the platform. We use no cookies, no analytics or advertising services and no third-party services for this.

Only our administration and course management see the log. We use it to organise your course and help you with problems, to be able to show our client that the agreed service was provided, and to detect misuse and unauthorised access.

4. Lessons and recordings

• Online lessons run on a video server that we operate ourselves in a data centre in Germany. Sound and picture are not passed to other providers.
• Individual lessons may be recorded and transcribed. This is stated beforehand for the lesson, and everyone sees a notice in the room. Only your group, the teacher and the school see the recording. The transcript is made on our own server.
• Meetings outside the timetable (such as a meeting with your curator, an extra lesson or a job interview) are transcribed only with your consent: you are asked before you enter the room. If you say no, your voice is not turned into text. A language model running on our own server writes a summary from the transcript. Only the administration and the curator of the meeting read the transcript and the summary; you receive the summary when it is shared with you.
• Homework is checked and graded only by your teacher. Transcripts and summaries are made on our own server: your details, submissions, recordings and transcripts are not sent to any AI provider.
• We check uploaded files for malware on our own server.

If you do not want to be recorded, you can keep your camera and microphone switched off and object to the recording at any time (section 10).

5. What we use the data for and on which legal basis

• To provide your account and to plan and run your course – including invitation, tests, attendance, homework and feedback: performance of the user agreement with you (Art. 6(1)(b) GDPR).
• To coordinate the course with our client and show it that the agreed service was provided, and for the usage log: our legitimate interest and that of our client in the proper performance of the course contract (Art. 6(1)(f) GDPR).
• For recordings and transcripts of lessons: our legitimate interest in following up lessons and in their quality (Art. 6(1)(f) GDPR).
• For transcripts and summaries of meetings: your consent (Art. 6(1)(a) GDPR), which you give or refuse before each meeting.
• To protect the platform and the invitation links, detect misuse and temporarily lock accounts after too many failed attempts: our legitimate interest in secure operation (Art. 6(1)(f) GDPR).
• To contact you via WhatsApp if you wish: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in the settings.
• To meet legal obligations, such as tax and commercial retention duties for payments (Art. 6(1)(c) GDPR).

6. Who receives your data

• Our staff and teachers, as far as they need the data for their work.
• The company that pays for your course: it learns whether you have registered, your group, your level, your attendance, the share of homework handed in and the final result. It receives no content of your work, no grades for individual tasks, no comments of your teacher, no recordings and no usage log.
• Service providers working on our behalf and under our instructions (processors): hosting of the platform and the video server on servers in Germany – IONOS SE, Elgendorfer Str. 57, 56410 Montabaur; sending and receiving e-mails – STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin.
• If you pay yourself: the payment service Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, which handles the payment under its own responsibility. Its privacy policy applies.
• WhatsApp (Meta Platforms Ireland Ltd.) only if you have agreed to this way of contact. Data may be transferred to the USA; Meta is certified under the EU-U.S. Data Privacy Framework.

Beyond this we do not pass on or sell your data. It reaches countries outside the European Union only in the cases named above.

7. Cookies and storage in the browser

The platform uses only technically necessary cookies. Under § 25(2) no. 2 TDDDG no consent is required for them.

• ls_at – keeps you signed in; valid 10 minutes.
• ls_rt – extends your session without signing in again; valid 30 days.
• ls_locale – remembers the chosen language; valid 1 year.
• ls_join – keeps the registration open after an invitation link was opened, so that the link does not have to stay in the address bar; valid 30 minutes.
• ls_code – ties the confirmation code sent by e-mail to the browser that asked for it; valid 5 minutes.
• ls_consent – remembers your choice in the cookie notice; kept in your browser's local storage for at most 12 months and not sent to us.

While you fill in the registration form, your browser keeps a draft in session storage so that nothing is lost on reload. The password is not stored. The draft is deleted when you finish registering or close the tab.

We use no analytics or advertising cookies and load no fonts, scripts or content from other servers. The usage log (section 3) works without cookies.

8. How long we keep your data

• Account, form details, learning results, homework and e-mails with you: up to 24 months after the end of your last course, or until you delete your account.
• Deleted accounts: name, e-mail address and phone number are made unrecognisable at once; the rest is removed for good after 30 days.
• Usage log and security logs: 12 months. IP addresses and their check values: 90 days.
• Recordings and transcripts of lessons: 180 days after the lesson.
• Transcripts of meetings: 180 days after the meeting; its summary stays with the meeting as long as the school needs it for its work.
• Signed-in devices: 60 days after sign-in. Counters of failed sign-ins: at most 24 hours.
• Confirmation codes for invitation links: valid 5 minutes; unconfirmed requests are deleted after 30 days.
• Unused invitations: 30 days after they expire.
• Payments: 10 years, as tax and commercial law require (§ 147 AO, § 257 HGB).

Statutory retention periods remain unaffected.

9. How we protect your data

The connection to the platform is encrypted. Passwords are hashed with a modern method; particularly sensitive data – phone numbers, documents, transcripts, e-mails – is additionally stored encrypted. Invitation links contain a long random key that cannot be guessed; we store it only as a check value or encrypted and do not write it into logs. Access is limited by role, and two-factor sign-in is mandatory for staff.

10. Your rights

You have the right of access (Art. 15 GDPR) – on request this includes your usage log –, rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on our legitimate interest, such as the usage log or recordings, on grounds relating to your particular situation (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)).

Much of this you can do yourself in the settings: download your data, correct your profile, withdraw the WhatsApp consent and delete your account. For anything else an e-mail to welcome@lernsfera.com is enough.

The rights of access and erasure may be restricted in the narrow cases of §§ 34 and 35 BDSG – for example where data are kept only because the law requires us to retain them. We will then tell you why.

You can also complain to a data protection supervisory authority, for example where you live or where we are based (Art. 77 GDPR, § 19 BDSG).

11. Do you have to provide the data? Are there automated decisions?

We need your name, e-mail address, password and the details in the registration form to create your account and plan your course. Without them you cannot use the platform. Decisions that concern you – for example about your group, your level or the grading of your work – are always made by people. There is no solely automated decision within the meaning of Art. 22 GDPR.

12. Changes to this policy

We adapt this policy when the platform or the law changes. The current version is always here; we inform you about significant changes on the platform.