1. Introduction

PrepDeutsch is committed to protecting your privacy and personal data. This privacy policy explains how we collect, use, share, and protect your information in accordance with the General Data Protection Regulation (GDPR).

2. Data Controller

The data controller for your personal data is:

3. Data Collected

We collect the following categories of data:

3.1 Identification Data

• First and last name
• Email address
• Password (encrypted)
• Preferred language
• Time zone

3.2 Usage Data

• Progress in exercises and lessons
• Test and exam results
• Time spent on the platform
• Learning preferences
• Platform browsing history

3.3 Technical Data

• IP address
• Browser type
• Operating system
• Cookie data
• Connection logs

3.4 Payment Data

Payment information is processed securely by our PCI-DSS certified payment providers. We do not store your complete banking details.

4. Processing Purposes

We use your data for the following purposes:

• Provide and improve our learning services
• Personalize your user experience
• Track your progress and adapt content to your level
• Manage your account and subscriptions
• Process your payments securely
• Send you important communications about the service
• Respond to your support requests
• Prevent fraud and ensure security
• Comply with our legal obligations
• Analyze usage to improve the platform

5. Legal Basis for Processing

We process your data on the following legal bases:

• Contract performance: provision of the learning service
• Consent: marketing communications (revocable at any time)
• Legitimate interest: service improvement, security, fraud prevention
• Legal obligation: retention of accounting data, fraud prevention

6. Data Sharing

We never sell your personal data. We may share your data with:

• Service providers: hosting (AWS, Vercel), payment (Stripe), analytics (Vercel Analytics)
• Legal authorities: if required by law or to protect our rights
• Educational partners: with your explicit consent

All our service providers are bound by strict confidentiality agreements compliant with GDPR.

7. International Transfers

Your data may be transferred to servers located outside the European Union. In such cases, we ensure that appropriate safeguards are in place (EU standard contractual clauses, EU-US Data Privacy Framework).

8. Retention Period

We retain your personal data for:

• Active account: for the entire duration of your use of the service
• Closed account: 3 months after closure (to allow reopening)
• Payment data: 10 years (legal accounting obligation)
• Connection data: 1 year (security)
• Cookies: maximum 13 months

9. Your GDPR Rights

In accordance with GDPR, you have the following rights:

• Right of access: obtain a copy of your personal data
• Right to rectification: correct your inaccurate or incomplete data
• Right to erasure: delete your data under certain conditions
• Right to restriction: restrict the processing of your data
• Right to portability: receive your data in a structured format
• Right to object: object to the processing of your data
• Right to withdraw consent: at any time
• Right to lodge a complaint: with the supervisory authority

To exercise your rights, contact us at: privacy@prepdeutsch.com

We will respond to your request within a maximum of 30 days.

10. Data Security

We implement appropriate technical and organizational security measures:

• Data encryption in transit (TLS 1.3)
• Data encryption at rest
• Passwords hashed with secure algorithms
• Role-based access control (RBAC)
• Access monitoring and logging
• Regular and secure backups
• Regular security testing
• Staff training on data security

11. Cookies and Similar Technologies

We use cookies for:

• Essential cookies: necessary for the service to function (session, authentication)
• Preference cookies: remember your choices (language, theme)
• Analytical cookies: understand service usage (with your consent)

You can manage your cookie preferences via our consent banner or your browser settings.

12. Minors

Our service is accessible to minors over 13 years old. For minors aged 13 to 15, parental consent is required in accordance with GDPR.

13. Policy Modifications

We may update this privacy policy. Any substantial changes will be notified to you by email or via a notification on the platform. The date of last update is indicated at the top of this document.

14. Contact

For any questions regarding this privacy policy or your personal data: