Privacy policy

1. Information on the collection of personal data

1.1 Below we inform you about the collection of personal data when you use our website in connection with participation in online tutoring by Crefolo. Personal data is all data that can be related to you personally, for example name, address, email addresses and order information.

1.2 The controller responsible for the data collection and processing described below is Crefolo, Stadtseestraße 25, 74189 Weinsberg, Germany, phone 0162 890 4641, email info@crefolo.com. Your contact person for customer matters is Nitin Kabadi-Srinivasa.

Data subjects may also address any objection to info@crefolo.com.

1.3 When you contact us by email, WhatsApp or via the booking form, the data you provide (your email address and, if applicable, your name and phone number) is stored by us in order to answer your questions. As always, we delete the data arising in this context once storage is no longer necessary, or we restrict processing if statutory retention obligations exist.

2. Collection of personal data when booking a trial lesson

2.1 When you book a trial lesson via our website, we collect the following data required for the performance of the contract and for pre-contractual measures (legal basis: Article 6(1) sentence 1 lit. b GDPR):

First name and age of your child
Your name (voluntary)
Contact details such as email address and phone number
The chosen appointment as well as the date and time of the booking
Your voluntary message to us

2.2 The purpose of this data collection is to organise the trial lesson, to send you the confirmation with the access link, to remind you of the appointment and to provide you with further contract-related information about the online tutoring.

2.3 To organise the trial lesson, an appointment is created in our Google Calendar and a Google Meet link is generated for the video connection. In doing so, your child's first name and age and your contact details are transmitted to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may also process data in the USA; Google is certified under the EU-US Data Privacy Framework. Further information: https://policies.google.com/privacy.

2.4 We send confirmation, reminder and cancellation emails from our mailbox at Microsoft 365 (Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). Further information: https://privacy.microsoft.com/en-gb/privacystatement.

2.5 If you merely use our website for information purposes, we only collect the personal data that your browser transmits to our server (see section 3).

3. Hosting, bot protection and cookies

3.1 Our website is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (Cloudflare Germany GmbH, Rosental 7, 80331 Munich, as EU representative). When you access the website, Cloudflare processes technically necessary data such as IP address, date and time of access, page accessed, browser type and operating system in order to deliver the website and protect it from attacks. The legal basis is Article 6(1) sentence 1 lit. f GDPR (legitimate interest in the secure and fast operation of the website). Cloudflare is certified under the EU-US Data Privacy Framework. Further information: https://www.cloudflare.com/privacypolicy/.

3.2 To protect the booking form from automated requests (spam), we use Cloudflare Turnstile. Turnstile checks technical characteristics of the browser to determine whether a request comes from a human and may set a technically necessary cookie for this purpose. No usage profiles are created. The legal basis is Article 6(1) sentence 1 lit. f GDPR.

3.3 Our website does not use any analytics, tracking or marketing cookies and no web analytics services.

4. Collection of personal data when contacting us by email or WhatsApp

When you contact us (for example by email, phone or WhatsApp), we store your details to process the enquiry and in case follow-up questions arise. This also constitutes our legitimate interest under Article 6(1) sentence 1 lit. f GDPR. We only store and use further personal data if you consent or if this is legally permitted without special consent.

When you contact us via WhatsApp, data is processed by WhatsApp Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. Using WhatsApp is voluntary; you can always reach us by email or phone instead. Further information: https://www.whatsapp.com/legal/privacy-policy-eea.

5. Disclosure of personal data to third parties

Your personal data such as name, email and phone number is used exclusively for communicating with you and organising the lessons.

We will never sell your data and – apart from the technical service providers named in this policy – will not pass it on.

We never use your data for marketing purposes.

In addition, in certain cases we are legally obliged to make personal data available to German and international authorities, Article 6(1) sentence 1 lit. c GDPR.

6. Your rights

6.1 You have the following rights vis-à-vis us with regard to the personal data concerning you:

Right of access regarding the categories of data processed, purposes of processing, any recipients of the data and the planned storage period (Article 15 GDPR);
Right to rectification or completion of inaccurate or incomplete data (Article 16 GDPR);
Right to withdraw consent at any time with effect for the future (Article 7(3) GDPR);
Right to object to data processing based on a legitimate interest, on grounds relating to your particular situation (Article 21(1) GDPR);
Right to erasure of data in certain cases (Article 17 GDPR);
Right to restriction of processing where erasure is not possible or the obligation to erase is disputed (Article 18 GDPR);
Right to data portability (Article 20 GDPR).

6.2 You also have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data (Article 77(1) GDPR). The competent supervisory authority is the state data protection officer of the federal state in which our company is based. A list of data protection officers and their contact details can be found at: https://www.bfdi.bund.de

7. Storage period

Unless statutory provisions require otherwise, stored data is deleted as soon as the contractual relationship has ended and all related matters have been settled. Data from a trial lesson that is not followed by lessons is deleted no later than six months after the appointment.