Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

German Education Factory GmbH (GEDUFA)
Reisholzer Werftstraße 35, 40589 Düsseldorf
Email: info@gedufa.de
Phone: +49 211 50948734

2. Data We Collect

We collect personal data when you:

• visit our website (technical access data)
• fill in a contact or registration form
• request a consultation appointment via our calendar
• upload documents via the application form
• contact us by email or telephone

Depending on how you get in touch, the data collected may include: name, email address, phone number, country of origin, language level, desired course/training pathway and uploaded documents (e.g. certificates, ID copies).

3. Legal Bases for Processing

We process your personal data on the following legal bases pursuant to Art. 6 GDPR:

• Art. 6(1)(a) GDPR – Consent (e.g. cookie consent)
• Art. 6(1)(b) GDPR – Performance of a contract or pre-contractual measures (e.g. course registration)
• Art. 6(1)(c) GDPR – Compliance with a legal obligation
• Art. 6(1)(f) GDPR – Legitimate interests (e.g. website operation, IT security)

4. Contact and registration forms

When you use our contact, application or registration forms, we process the information you provide to handle your enquiry or registration. Depending on the website and form, submissions are processed by our own HTML form handlers or WordPress forms using Contact Form 7. The information is transmitted over HTTPS to our GEDUFA administration system and assigned to the relevant enquiry, registration and contact.

Authorised GEDUFA staff use this information to process your request. Acknowledgements and subsequent responses are sent through our integrated email service. Our hosting and email service providers process the data required to provide these services.

5. Consultation requests

You can select an available preferred date in our consultation calendar and submit your contact details and, optionally, a message. The request is stored in our GEDUFA administration system, and the GEDUFA team is notified by email. We use this information to review and arrange your consultation.

Submitting a request does not confirm the appointment. You will receive a separate confirmation from GEDUFA after an internal review. This calendar is processed through our own system.

6. Optional document uploads

You may upload documents such as certificates or official notices during registration or an application. Uploads are optional. For course and exam registrations, you can also submit documents later using the personal upload link in your acknowledgement email.

Files are encrypted during transmission using HTTPS/TLS and stored with restricted access. They are assigned to your registration or application and contact record. Only authorised staff can retrieve them through the administration system. Your personal upload link allows you to submit further documents for the associated registration; it does not provide access to documents already stored. Please keep this link confidential. Files are retained only for the purposes and periods described in section 9.

7. Cookies

Our website uses cookies – small text files stored in your browser. We distinguish between:

• Necessary cookies: Technically required for the operation of the website (e.g. session cookie, cookie consent). No consent required.
• Functional cookies: Store your preferences (e.g. language setting). Only after consent.
• Analytics cookies: Only set if you have expressly consented.

You can adjust or withdraw your cookie settings at any time under Cookie Settings.

8. Integrated Third-Party Services

Google Fonts

We load fonts from Google Fonts (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When the page loads, your IP address is transmitted to Google servers. Legal basis: Art. 6(1)(f) GDPR. Further information: Google Privacy Policy.

Font Awesome (jsDelivr CDN)

Icons are provided via the jsDelivr CDN (ProspectOne Sp. z o.o., Poland). Your IP address is transmitted to CDN servers. Legal basis: Art. 6(1)(f) GDPR.

Tailwind CSS & Alpine.js (CDN)

Styling and interaction libraries are loaded via external CDNs. Your IP address may be transmitted to the CDN operators in the process.

Cloudflare Turnstile

To protect our forms from spam, we may use Cloudflare Turnstile (Cloudflare Inc., USA). Cloudflare processes technical data to verify that users are human. More information: Cloudflare Privacy Policy.

9. Retention Periods

Your personal data is only stored for as long as necessary for the respective processing purpose or as required by statutory retention obligations. Specifically:

• Contact enquiries: 2 years after completion of the matter
• Appointment and registration data: Duration of the business relationship, then 3 years
• Application documents: 6 months after completion of the process if no contract is concluded
• Statutory retention obligations: up to 10 years (e.g. tax-relevant documents)

10. Your Rights as a Data Subject

Under the GDPR you have the following rights:

• Access (Art. 15 GDPR): You may request information about the data stored about you.
• Rectification (Art. 16 GDPR): You have the right to have inaccurate data corrected.
• Erasure (Art. 17 GDPR): You may request deletion of your data, provided no statutory retention obligations apply.
• Restriction (Art. 18 GDPR): You may request restriction of processing.
• Data portability (Art. 20 GDPR): You may receive your data in a machine-readable format.
• Objection (Art. 21 GDPR): You may object to the processing of your data.
• Withdrawal (Art. 7(3) GDPR): You may withdraw consent given at any time with effect for the future.

To exercise your rights, please contact: info@gedufa.de

You also have the right to lodge a complaint with the competent data protection supervisory authority. The authority responsible for NRW is:
State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW)
www.ldi.nrw.de

11. Data Security

We implement technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss or alteration as well as against unauthorised disclosure or access. Transmission between your browser and our server is exclusively via an encrypted SSL/TLS connection (indicated by "https://" in the address bar).

12. Changes to this Privacy Policy

We reserve the right to update this privacy policy to reflect changes in the legal situation or changes to our services. The current version is always available on this page. The date of the last update is shown at the top of this page.