1. Controller

The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the member states, as well as other data protection provisions, is:

Tatiana Beckmann
NALEX LAB
c/o IP-Management #5094
Ludwig-Erhard-Str. 18
20459 Hamburg
Germany

Email: info@nalex-german.de
Website: https://nalex-german.de

If you have any questions or concerns regarding data protection, you are welcome to contact us at any time using the email address stated above.

2. General Information

2.1 Data Protection at a Glance

The protection of your personal data is important to us. We treat your personal data confidentially and in accordance with the applicable statutory provisions, in particular the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG).

This Privacy Policy informs you about the type, scope, and purpose of the processing of personal data within our online offering at https://nalex-german.de as well as in connection with the language courses and services offered by us (jointly referred to below as the "Website" or "Offering").

2.2 Personal Data

Personal data is any information relating to an identified or identifiable natural person. This includes, among other things, your name, address, email address, telephone number, as well as usage data generated in connection with your use of our Website.

2.3 Controller within the Meaning of the GDPR

The controller within the meaning of the GDPR is the natural person named in Section 1, who alone or jointly with others determines the purposes and means of the processing of personal data.

2.4 Withdrawal of Your Consent to Data Processing

Where data processing is based on your consent (Art. 6 (1)(a) GDPR), you have the right to withdraw this consent at any time with effect for the future. The lawfulness of the data processing carried out prior to the withdrawal remains unaffected. The withdrawal may be declared informally, in particular by email to info@nalex-german.de.

3. Legal Bases for Processing

Where we obtain the consent of the data subject for processing operations involving personal data, Art. 6 (1)(a) GDPR serves as the legal basis for the processing.

For the processing of personal data required for the performance of a contract to which the data subject is a party, Art. 6 (1)(b) GDPR serves as the legal basis. This also applies to processing operations required for carrying out pre-contractual measures, for example in connection with enquiries about our language courses.

Where processing of personal data is necessary for compliance with a legal obligation to which our company is subject (e.g. obligations under commercial and tax law to retain records), Art. 6 (1)(c) GDPR serves as the legal basis.

Where processing is necessary to protect a legitimate interest of our company or of a third party and the interests, fundamental rights, and fundamental freedoms of the data subject do not override the aforementioned interest, Art. 6 (1)(f) GDPR serves as the legal basis for the processing. Legitimate interests in this sense include, in particular, our interest in maintaining the operation of our Website, in ensuring IT security, and in the efficient and secure administration of our course offerings and customer relationships.

4. Hosting via Vercel

4.1 Scope of Processing

Our Website is hosted by the provider Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA (hereinafter "Vercel"). Vercel provides us with the technical infrastructure used to operate, deliver, and make our Website accessible to users.

Each time our Website is accessed, Vercel automatically processes technical connection data (including IP address, date and time of access, pages accessed, browser used, operating system) that is technically necessary for the operation and security of the Website. For further details, please see Section 6 (Server Log Files).

4.2 Purpose and Legal Basis

The use of Vercel is based on our legitimate interest in a technically stable, high-performance, and secure provision of our online offering pursuant to Art. 6 (1)(f) GDPR.

4.3 Data Processing Agreement and Transfer to Third Countries

We have entered into a data processing agreement (Art. 28 GDPR) with Vercel, which obliges Vercel to process the data of our website visitors only on our instructions and in compliance with the GDPR.

As Vercel is headquartered in the USA, the processing of data may involve the transfer of personal data to a third country outside the European Economic Area. In such cases, we ensure that an adequate level of data protection is guaranteed, in particular through the conclusion of the EU Standard Contractual Clauses (Art. 46 (2)(c) GDPR) with Vercel, as well as, where applicable, additional contractual and technical safeguards.

Further information on data protection at Vercel is available at: https://vercel.com/legal/privacy-policy

5. Domain Management via IONOS

Registration and management of the domain https://nalex-german.de is carried out via IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany (hereinafter "IONOS").

In the course of domain registration and management, IONOS, acting as registrar, processes certain identification data (e.g. name, address, email address of the domain holder) to the extent necessary for the registration, administration, and technical operation of the domain, as well as to comply with the requirements of the relevant registry (e.g. DENIC eG for ".de" domains).

The legal basis for this is Art. 6 (1)(b) GDPR, insofar as the management of the domain serves the performance of a contract, as well as Art. 6 (1)(f) GDPR with regard to our legitimate interest in the reliable technical and administrative management of our online presence. Where required, a data processing agreement pursuant to Art. 28 GDPR is in place with IONOS.

Further information on data protection at IONOS is available at: https://www.ionos.de/terms-gtc/terms-privacy

6. SSL/TLS Encryption

For security reasons and to protect the transmission of confidential content, such as inquiries you send to us as the website operator, this Website uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address bar of your browser changes from "http://" to "https://" and by the padlock icon displayed in your browser bar.

When SSL or TLS encryption is activated, the data you transmit to us cannot be readily read by third parties.

7. Server Log Files

The provider of our Website (see Section 4, Vercel) automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

• Browser type and browser version
• Operating system used
• Referrer URL (previously visited page)
• Host name of the accessing computer
• Time of the server request
• IP address

This data is not merged with other data sources. This data is collected on the basis of Art. 6 (1)(f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimisation of its Website; for this purpose, server log files must be recorded. This data is not used to draw conclusions about your identity.

The storage period for server log files is determined by technical and security requirements and generally does not exceed 30 days, unless a statutory retention obligation or a security-related incident requires longer storage.

8. Contact Form

If you send us enquiries via the contact form provided on our Website, the information you provide in the enquiry form, including the contact details you provide there (e.g. name, email address, telephone number), will be stored by us for the purpose of processing your enquiry and in case of follow-up questions.

The processing of this data is based on Art. 6 (1)(b) GDPR, insofar as your enquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures, for example in connection with enquiries about our language courses. In all other cases, the processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6 (1)(f) GDPR) and, where applicable, on your consent (Art. 6 (1)(a) GDPR), insofar as such consent has been requested.

The data entered by you in the contact form will remain with us until you request that we delete it, you withdraw your consent to its storage, or the purpose for which the data is stored no longer applies (e.g. after your enquiry has been fully processed). Mandatory statutory provisions – in particular statutory retention periods under commercial and tax law – remain unaffected.

9. Communication by Email

If you contact us by email, the data you provide (e.g. email address, and, where applicable, your name, telephone number, and the content of your message) will be processed by us in order to handle and respond to your enquiry.

The legal basis for processing data transmitted in the course of an email is Art. 6 (1)(b) GDPR, insofar as the communication serves the initiation or performance of a contract, or otherwise Art. 6 (1)(f) GDPR based on our legitimate interest in responding to enquiries.

We would like to point out that the transmission of data via email over the internet cannot be fully protected against access by third parties. We therefore recommend an alternative means of communication for the transmission of particularly sensitive information.

Data collected in connection with email communication will be deleted as soon as its storage is no longer necessary, or its processing will be restricted where statutory retention obligations apply.

10. Course Bookings

10.1 Scope of Processing

When booking a language course, we collect and process the data necessary for carrying out the booking process and for the performance of the contract. This includes, in particular:

• First and last name
• Address
• Email address
• Telephone number (where provided)
• Details of the booked course (e.g. course type, course period, language level)
• Payment data or details of the chosen method of payment
• Where applicable, information regarding special needs relevant to the delivery of the course, provided voluntarily by you

10.2 Purpose and Legal Basis

This data is processed to carry out pre-contractual measures and to perform the course contract concluded with you, in particular for enrolment, allocation to course groups, invoicing, and communication in connection with the course. The legal basis is Art. 6 (1)(b) GDPR.

Insofar as the processing is necessary to comply with retention obligations under commercial and tax law, we additionally rely on Art. 6 (1)(c) GDPR.

10.3 Storage Period

Data collected in the course of booking a course is stored for the duration of the contractual relationship and, beyond that, in accordance with statutory retention periods (in particular pursuant to Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB), generally between six and ten years).

11. Participant Management

For the organisational delivery of our language courses, we maintain a participant management system in which we process the data of enrolled participants necessary for course delivery. This includes, in particular, contact details, information about the booked course and course group, attendance records, and, where necessary for educational support purposes, information on learning progress.

Processing takes place for the performance of the course contract pursuant to Art. 6 (1)(b) GDPR and, insofar as organisational purposes beyond direct contract performance are concerned, on the basis of our legitimate interest in the orderly and high-quality delivery of courses pursuant to Art. 6 (1)(f) GDPR.

Data stored within the framework of participant management is deleted as soon as it is no longer required for the delivery of the respective course, provided no statutory retention periods apply.

12. Customer Account (If Activated)

Where we offer you the option of creating a customer account on our Website, we process the data provided by you during registration and use of the customer account (e.g. name, email address, password in encrypted form, booked courses, booking history) as part of registration and use of the account.

The customer account is intended to give you simplified access to your bookings, invoices, and personal data, and to facilitate the booking process for future courses.

The legal basis for the establishment and maintenance of the customer account is Art. 6 (1)(b) GDPR, as the provision of the customer account serves the performance or initiation of a contract. Creating a customer account is voluntary; it is not a mandatory prerequisite for booking a course, provided we also offer the option to book without a customer account.

You may have your customer account deleted at any time via the corresponding function on our Website or by informal notice to info@nalex-german.de. Following deletion of the customer account, the corresponding data will be deleted, unless statutory retention obligations or other legitimate interests (e.g. the assertion, exercise, or defence of legal claims) preclude deletion.

13. Supabase (Database, Authentication, and Storage)

13.1 Scope of Processing

For the technical implementation of our online offering, in particular for the storage of user and course data, for authentication (e.g. login to a customer account), and for the storage of files, we use the service Supabase, provided by Supabase, Inc., 970 Toa Payoh North #07-04, Singapore, or its European infrastructure partners (hereinafter "Supabase").

Depending on your use of our Offering, the following data may in particular be processed and stored via Supabase:

• Registration and account data (e.g. name, email address, password hash)
• Authentication data (e.g. session tokens, login timestamps)
• Booking and participant data in connection with our language courses
• Files uploaded by users, insofar as a corresponding function is offered

13.2 Purpose and Legal Basis

The use of Supabase serves to technically provide the database, authentication, and storage functions of our online offering, and thus the performance of our contractual relationships with you (Art. 6 (1)(b) GDPR), as well as our legitimate interest in a reliable, secure, and scalable technical infrastructure (Art. 6 (1)(f) GDPR).

13.3 Data Processing Agreement and Transfer to Third Countries

Where required, we have entered into a data processing agreement with Supabase pursuant to Art. 28 GDPR. Insofar as the use of Supabase involves the transfer of personal data to third countries outside the European Economic Area, we ensure an adequate level of data protection, in particular through the conclusion of the EU Standard Contractual Clauses (Art. 46 (2)(c) GDPR) and, where applicable, additional technical and organisational measures.

Further information on data protection at Supabase is available at: https://supabase.com/privacy

14. AI Features (Only Where Actively Used by the User)

Insofar as we offer optional, AI-supported features on our Website (for example, to support learning, to answer questions, or to automatically evaluate exercises), these features are used exclusively where you actively use or invoke them.

Where such AI features are actively used, the content you enter (e.g. text input, questions, exercise answers) may be transmitted to the respective AI service provider for processing in order to provide you with a corresponding response or evaluation. Transmission takes place only to the extent of the input you specifically make, and only where you actively invoke the respective feature.

The legal basis for this processing is, insofar as the use of the AI feature forms part of the booked course offering or the contractual relationship, Art. 6 (1)(b) GDPR. Insofar as the use is based on a separate, express decision by the user that goes beyond mere contract performance, we additionally base the processing on your consent pursuant to Art. 6 (1)(a) GDPR, which you grant through the active use of the respective feature and which you may withdraw at any time with effect for the future.

Please note that processing by the AI service provider used may take place outside the European Union. In such cases, we ensure an adequate level of data protection through appropriate safeguards, in particular by concluding the EU Standard Contractual Clauses (Art. 46 (2)(c) GDPR) and corresponding contractual arrangements with the respective provider.

When using AI features, please refrain from entering special categories of personal data (Art. 9 GDPR) or other particularly sensitive information that is not required for the use of the feature.

15. PayPal Checkout

If you choose PayPal as your method of payment during the order or booking process, payment processing is carried out via the payment service provider PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal").

If you select this payment method, the data you enter during the order process (e.g. name, address, invoice amount, and, where applicable, account details) is automatically transmitted to PayPal. The transmission of your data is carried out exclusively for the purpose of payment processing with the payment service provider PayPal, and only to the extent necessary for this purpose.

The legal basis for the transmission of your data is Art. 6 (1)(b) GDPR (performance of a contract), insofar as the payment is necessary for the performance of a contractual relationship, as well as Art. 6 (1)(f) GDPR based on our legitimate interest in secure, efficient, and convenient payment processing.

PayPal processes your data as an independent controller in accordance with the applicable data protection provisions. Further information can be found in PayPal's privacy policy at: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

16. Bank Transfer (Advance Payment)

If you choose to pay by bank transfer in advance, we process the data necessary for payment processing (e.g. name of the account holder, bank details, payment reference, payment amount) as well as the booking data required to allocate your payment.

This data is processed for the performance of the contractual relationship existing with you pursuant to Art. 6 (1)(b) GDPR, and, insofar as retention obligations under commercial and tax law are concerned, on the basis of Art. 6 (1)(c) GDPR.

The transmission of transfer data is carried out via the credit institution used by you, which acts as an independent controller within the meaning of the GDPR.

17. Invoice Payment for Businesses

For business customers, we may offer the option of purchasing or booking a course on an invoice basis. In this case, we process the data required for invoicing, in particular the company name, business address, contact person, email address, VAT identification number (where provided), and the data required for payment processing and monitoring of payment receipt.

The legal basis for this processing is Art. 6 (1)(b) GDPR with regard to the performance of the contractual relationship existing with the business, as well as Art. 6 (1)(c) GDPR with regard to compliance with obligations under commercial and tax law, in particular the proper issuance of invoices and bookkeeping pursuant to Section 14 of the German VAT Act (UStG), Section 147 of the German Fiscal Code (AO), and Section 257 of the German Commercial Code (HGB).

Where there is a legitimate interest in assessing the creditworthiness of a business customer prior to granting a payment term, we may, to the extent necessary, obtain credit reports; in this case, processing is based on Art. 6 (1)(f) GDPR.

18. Cookies

18.1 What Are Cookies?

Our Website uses cookies. Cookies are small text files that are stored on your device (computer, tablet, smartphone, etc.) when you visit our Website. Cookies do not cause any damage to your device and do not contain viruses.

18.2 Technically Necessary Cookies

We use exclusively technically necessary cookies that are essential for the operation of the Website and for the provision of certain functions expressly requested by you (e.g. login to a customer account, shopping cart or booking function, ensuring cross-session navigation).

These technically necessary cookies do not collect or process personal data for advertising or analytics purposes. The legal basis for the use of technically necessary cookies is Art. 6 (1)(f) GDPR, based on our legitimate interest in providing our Website in a technically flawless and user-friendly manner, as well as, insofar as the cookies are required to provide a function expressly requested by you (e.g. login), Art. 6 (1)(b) GDPR.

As we do not use any cookies that are not technically necessary (e.g. for advertising, marketing, or analytics purposes), no separate consent within the meaning of Section 25 of the German Telecommunications and Telemedia Data Protection Act (TTDSG) is required for the cookies used on our Website.

18.3 Management and Objection

You can prevent the storage of cookies on your device by selecting "do not accept cookies" in your browser settings. You may also delete cookies already stored at any time via your browser settings. Please note that in this case, not all functions of our Website may be fully usable.

19. Storage Period

Insofar as no more specific storage period has been stated in this Privacy Policy, your personal data will remain with us until the purpose for the data processing no longer applies. If you assert a legitimate request for erasure or withdraw your consent to data processing, your data will be deleted, unless we have other legally permissible grounds for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, deletion will take place once these grounds cease to apply.

In particular, the following statutory retention periods apply:

• Retention obligations under commercial law pursuant to Section 257 of the German Commercial Code (HGB) (generally six or ten years)
• Retention obligations under tax law pursuant to Section 147 of the German Fiscal Code (AO) (generally six or ten years)

20. Recipients of Personal Data

In the course of our business activities, we disclose personal data to third parties only where this is necessary for the performance of a contract, we are legally obliged to do so, you have given your consent, or there is a legitimate interest in the disclosure. Possible recipients include, in particular:

• Vercel Inc. (hosting service provider, see Section 4)
• IONOS SE (domain management, see Section 5)
• Supabase, Inc. or its European infrastructure partners (database, authentication, and storage service provider, see Section 13)
• PayPal (Europe) S.à r.l. et Cie, S.C.A. (payment service provider, see Section 15), where you select this payment method
• AI service providers used, where applicable (see Section 14), insofar as you actively use the corresponding features
• our tax advisor or accounting department, insofar as required to comply with statutory obligations
• authorities and public bodies, insofar as we are legally obliged to provide information

Where the aforementioned service providers act as processors on our behalf, we have entered into corresponding data processing agreements pursuant to Art. 28 GDPR, ensuring that your data is processed only on our instructions and in compliance with statutory requirements.

21. Rights of Data Subjects

You have the following rights with regard to the processing of your personal data:

21.1 Right of Access

You have the right, pursuant to Art. 15 GDPR, to request confirmation as to whether personal data concerning you is being processed by us, and, where applicable, to obtain access to that data. In particular, you may request information about the purposes of processing, the categories of personal data processed, the recipients or categories of recipients to whom your data has been or will be disclosed, the envisaged storage period, the existence of a right to rectification, erasure, restriction of processing, or objection, the existence of a right to lodge a complaint, the source of your data where it was not collected from you, and the existence of automated decision-making, including profiling, and, where applicable, meaningful information about the details thereof.

21.2 Right to Rectification

You have the right, pursuant to Art. 16 GDPR, to request the immediate rectification of inaccurate personal data concerning you or the completion of incomplete personal data stored by us.

21.3 Right to Erasure

You have the right, pursuant to Art. 17 GDPR, to request the erasure of personal data stored by us, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defence of legal claims.

21.4 Right to Restriction of Processing

You have the right, pursuant to Art. 18 GDPR, to request the restriction of the processing of your personal data, among other things, if you contest the accuracy of the data, the processing is unlawful but you oppose its erasure, or we no longer need the data but you require it for the establishment, exercise, or defence of legal claims.

21.5 Right to Data Portability

You have the right, pursuant to Art. 20 GDPR, to receive personal data you have provided to us in a structured, commonly used, and machine-readable format, or to request that it be transmitted to another controller, insofar as this is technically feasible.

21.6 Right to Object

You have the right, pursuant to Art. 21 GDPR, to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6 (1)(f) GDPR. We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defence of legal claims.

21.7 Right to Withdraw Consent under Data Protection Law

You have the right to withdraw any consent to the processing of personal data given to us at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent prior to its withdrawal.

21.8 Exercising Your Rights

To exercise the aforementioned rights, you may contact us at any time in an informal manner, in particular by email to info@nalex-german.de or by post to the address stated in Section 1.

22. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work, or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

The supervisory authority responsible for us is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
(Hamburg Commissioner for Data Protection and Freedom of Information)
Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany
Telephone: +49 40 428 54-4040
Email: mailbox@datenschutz-hamburg.de
Website: https://datenschutz-hamburg.de

23. Data Security

We use the widely accepted SSL/TLS (Secure Socket Layer / Transport Layer Security) protocol in connection with the highest level of encryption supported by your browser during your visit to the Website (see Section 6).

In addition, we employ appropriate technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorised access by third parties. Our security measures are continuously improved in line with technological developments.

Despite careful technical and organisational security measures, the transmission of data over the internet can never be fully protected against access by third parties.

24. Changes to This Privacy Policy

We reserve the right to amend this Privacy Policy so that it continues to comply with current legal requirements, or to reflect changes to our services in the Privacy Policy, e.g. when introducing new services or features. The Privacy Policy applicable on your next visit will be the version then in effect, as published on our Website.

Last updated: July 2026

---

Note: This Privacy Policy is provided in English for the convenience of English-speaking users. The controller is established in Germany and the processing of personal data is governed by German and European data protection law (GDPR, BDSG, TTDSG). In the event of any discrepancies between this English version and the German version (Datenschutzerklärung), the German version shall prevail.