Legal

Privacy Policy

Datenschutzerklärung gemäß DSGVO / Art. 13 GDPR · Compliant with India’s DPDP Act, 2023

Last updated: September 2026

1. Data Controller (Verantwortlicher)

The controller for the personal data processed on this website is:

German Notes

Jile Singh Sorout

India

Email: hello@germannotes.org

German Notes is registered and run from India, but we also teach students in the EU and Germany. That means the EU General Data Protection Regulation (GDPR / DSGVO) applies to the personal data of EU residents under Art. 3(2) GDPR.

2. What Data We Collect and Why

2.1 Enrollment & Contact Forms

When you send an enrollment or contact form, we collect your name, email address, phone number, and what you want to learn. We use it to reply to you, confirm your batch placement, and stay in touch about your course.

Legal basis: Art. 6(1)(b) GDPR (needed to carry out a contract, or to take steps you asked for before one).

2.2 User Account

If you create an account, we store your name, email address, phone number, and the country you live in, and which of our free PDFs you download. We don’t have passwords. You sign in with Google (see 3.1) or with a one-time code we email you (see 3.3), so there is no password for us to store. We use your account data to sign you in and give you access to your course materials and progress.

Legal basis: Art. 6(1)(b) GDPR (contract performance).

When you register, you also agree that we may contact you by phone, WhatsApp or email about our German courses. Your country and the PDFs you downloaded help us suggest the right course. You can withdraw this consent at any time by telling us on WhatsApp or by email, and we will stop contacting you; your account stays active.

Legal basis for course contact: Art. 6(1)(a) GDPR (consent).

2.3 Placement Assessment

When you take our free placement test, we store your answers and result. We use them to recommend the right course level and, if you’re logged in, to track your progress.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in placing students in the right course).

2.4 Server & Access Logs

Our hosting servers automatically log standard access data for every request: IP address, browser type, pages requested, and timestamps. We use it for security, for example to spot automated scanning or attempts to break in.

We also keep our own record of page visits (IP address, browser, page visited, and the account you’re logged into, if any). If we ever have to look into suspicious activity or a security incident, this shows us what a particular visitor or account did on the site. Only site administrators can see it, and we never use it for marketing, advertising, or profiling.

We delete both types of logs after 30 days.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in protecting our servers and accounts from unauthorized access).

2.5 Student Records & Invoicing

If you enroll, our administrative staff keep a student record with your name, date of birth, address, phone number, email address, course and batch, and your marks, attendance, and grades, along with fee, payment, and invoicing records (amounts due and paid, payment status, due dates). We use this to manage your enrollment, track your progress, and send you fee notices, receipts, and confirmations.

Legal basis: Art. 6(1)(b) GDPR (needed to carry out our contract with you as an enrolled student).

3. Third-Party Services

3.1 Google Sign-In (OAuth)

You can choose “Continue with Google” to sign in. Google then shares your name and email address with us. We don’t receive your password or other Google account data. Google’s own privacy policy covers the sign-in step.

3.2 Hosting: Contabo

Our website and database run on servers operated by Contabo GmbH in Munich, Germany. Contabo processes data for us as a data processor under a Data Processing Agreement. All data is stored in the European Union.

3.3 Email & Sign-In Codes

We send transactional emails, such as enrollment confirmations and sign-in codes, from our own mail server. If you don’t sign in with Google, we email you a 6-digit one-time code. It works for a few minutes, and we don’t keep it once it expires or has been used. We don’t use third-party marketing platforms for automated campaigns unless you explicitly agree.

3.4 IP Geolocation (Currency Display)

On your first visit, we look up the country of your IP address with a third-party geolocation service (geojs.io) so we can show prices in the right currency (EUR or INR). We only store the resulting currency code, in a cookie for 7 days. We don’t store your IP address for this. Your IP address is still recorded separately in our access logs for security (see 2.4).

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in showing you accurate prices without making you pick a currency).

3.5 Website Analytics: Google Analytics

We use Google Analytics (provided by Google Ireland Limited, a subsidiary of Google LLC) to see how people use our site: visitor counts, approximate country and city, pages viewed, device type, and where visitors come from. Google Analytics sets cookies on your device, and it only runs after you accept it in the cookie banner on your first visit (see Section 7). We have turned on IP anonymization, so Google doesn’t store your full IP address.

Google processes this data on servers outside the European Economic Area. The transfer is covered by Google’s Standard Contractual Clauses and/or its certification under the EU-U.S. Data Privacy Framework. Google Analytics deletes the data automatically after 14 months.

Legal basis: Art. 6(1)(a) GDPR (your consent, given in the cookie banner). You can withdraw consent at any time by rejecting cookies when the banner comes back, or by clearing this site’s cookies in your browser, which brings the banner back on your next visit.

4. Data Retention

We keep personal data for as long as we need it to provide our services, or as long as the law requires:

  • Account data: kept until you delete your account or ask us to erase it.
  • Enrollment / lead data: kept for up to 3 years for business and accounting records.
  • Assessment results: kept while your account is active.
  • Student fee and invoice records: kept for 10 years. German commercial and tax law (§ 147 AO, § 257 HGB) and Indian income tax and company law both require this, because German Notes operates in both countries.
  • Server logs: deleted after 30 days.

5. Your Rights under the GDPR / DSGVO

You have these rights over your personal data:

  • Access (Art. 15 GDPR): ask for a copy of the data we hold about you.
  • Rectification (Art. 16 GDPR): ask us to correct data that is wrong.
  • Erasure (Art. 17 GDPR): ask us to delete your data when we no longer have a legal basis to keep it.
  • Restriction (Art. 18 GDPR): ask us to limit how we use your data in certain cases.
  • Portability (Art. 20 GDPR): get your data in a format a computer can read.
  • Objection (Art. 21 GDPR): object to processing that rests on our legitimate interests.
  • Withdrawing consent: where we rely on your consent, you can withdraw it at any time. Processing we did before then stays lawful.

To use any of these rights, email us at hello@germannotes.org. We’ll reply within 30 days.

6. Compliance with India's DPDP Act, 2023

German Notes is based in India and serves students there, so we also follow the Digital Personal Data Protection Act, 2023 (DPDP Act) for our Indian users. Under that Act, German Notes is the Data Fiduciary and you are the Data Principal.

Notice (Section 5, DPDP Act): this policy is our notice to you. It explains what personal data we collect, why, and how you can use your rights. Sections 2 and 3 have the full list, including how we use your IP address to show the right currency (3.4) and our website analytics (3.5).

Legal basis:when you give us data yourself (enrollment forms, account creation, the placement test) or accept Google Analytics cookies in our cookie banner (3.5), we rely on your consent. One small technical use is different: detecting your country to show accurate prices (3.4). It sets no cookie beyond the currency code, and we rely on the “certain legitimate uses” in Section 7 of the DPDP Act, because the data is used only for a purpose you would reasonably expect when you visit our website voluntarily.

Your rights as a Data Principalare to access information about the personal data we hold and how we process it, to have it corrected or erased, to have your grievances addressed, and to nominate another person to use these rights for you if you die or can’t act for yourself.

Grievance Officer: to make a complaint under the DPDP Act, email hello@germannotes.org. We’ll acknowledge and deal with it within 30 days.

7. Cookies

Strictly necessary cookieskeep you logged in, remember your currency (see 3.4), apply regional access rules, and remember your cookie choice. We set these automatically. Under the DSGVO they don’t need a consent banner.

Analytics cookiesfrom Google Analytics (see 3.5) aren’t essential, so we only set them after you click “Accept” on the cookie banner on your first visit. If you click “Reject” or ignore the banner, we don’t set them and we send nothing to Google. We don’t use advertising or cross-site tracking cookies.

8. No Automated Decision-Making

We don’t use your personal data for automated decisions or profiling that have legal or similarly significant effects on you.

9. Changes to This Policy

If we change this policy, we’ll post the new version on this page with an updated date. For significant changes, we’ll also email registered users.

10. Contact

Questions about privacy, or want to use your rights? Email hello@germannotes.org.

Also see our Terms of Service.

Get our experts to answer your questions within 24 Hrs

Chat with us
Free Placement TestBook Free Demo