Privacy Policy

1. Who is responsible

The controller is Use Your German, a private limited company registered in England and Wales with its registered office in London — the operator named in our Legal notice. For anything concerning your data, write to contact@useyourgerman.com.

We have not appointed a data protection officer, as the law does not require one for an organisation of our size.

2. Visiting the website

When you open our pages, your browser sends technical data that our hosting provider, Google Cloud, processes to deliver the pages and keep the service secure: your IP address, the date and time, the page requested, and your browser and operating system. These logs are kept for up to 30 days. Legal basis: our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR).

We use no analytics, no advertising and no tracking. Our fonts are served from our own servers, not from Google Fonts.

3. Cookies and storage on your device

We store only what the site needs to work the way you set it: your language, your time zone and your colour scheme, in cookies that last up to one year; and, in the student portal, your sign-in session and interface settings in your browser’s local storage. These are strictly necessary for the service you asked for, so they need no consent (regulation 6(4) of the UK Privacy and Electronic Communications Regulations and, for visitors in the EU, the national rules such as § 25(2) TDDDG in Germany; Art. 6(1)(f) GDPR). You can delete them in your browser at any time.

On the checkout pages only, our payment provider Stripe sets cookies to detect and prevent payment fraud — see section 5.

4. Your account

To create an account we need your name, your email address and a password. We store your password only as a one-way hash: nobody, including us, can read it. We also store your preferred language and whether you have confirmed your email address. Legal basis: the contract with you (Art. 6(1)(b) GDPR).

Signing in with Google: if you choose “Continue with Google”, Google confirms your identity and shares your name, your email address and your Google account ID with us. We use them only to create your account and sign you in; we receive nothing else from your Google account.

5. Bookings and payments

When you book a course or subscribe to a plan, we store what you bought, the price, the payment status and a payment reference, and we issue invoices in your name.

Payments are processed by Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland). Your card details go directly from your browser to Stripe; they never pass through or stay on our servers. Stripe receives your name, your email address, the amount and what you are paying for, and uses them to carry out the payment and to prevent fraud, including with cookies on the checkout pages. Stripe’s privacy policy: stripe.com/privacy.

Legal bases: the contract (Art. 6(1)(b) GDPR) and our obligations under tax and commercial law (Art. 6(1)(c) GDPR).

6. Your courses and sessions

We store your enrolments and your course schedule so that we can teach you and show you your courses in the student portal.

Live sessions and the Entry Call take place on Zoom (Zoom Communications, Inc., San Jose, USA), which you reach through the joining link we give you. When you join, Zoom processes your connection data and what you share in the session — your name as displayed, your voice and, if you switch it on, your image — under its own privacy policy (zoom.com/privacy). We do not record sessions.

Legal basis: the contract (Art. 6(1)(b) GDPR).

7. The emails we send

We send the emails the service needs: the link to confirm your email address, password-reset links, booking and membership confirmations with your schedule, invoices, and notices about changes to your sessions. They are sent from no-reply@useyourgerman.com through Brevo (Sendinblue SAS, Paris, France), which processes your email address and the content of the message to deliver it and records whether delivery succeeded.

We do not send newsletters or advertising without your consent. Legal basis: the contract (Art. 6(1)(b) GDPR).

8. Adding your sessions to Google Calendar (optional)

If you use “Add to Google Calendar” in the student portal, your browser asks Google for your permission to add events to your calendar. That permission is used once, in your browser, to create or update the events for your course’s sessions; nothing else in your calendar is read or changed. We never receive or store your Google access token or your calendar data. Legal basis: your consent, which you give by granting the permission and can withdraw at any time in your Google account (Art. 6(1)(a) GDPR).

Use Your German’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can also download your schedule as a calendar file instead, which involves no one else.

9. The Entry Call

If you book an Entry Call, we store your name, your email address, the day that suits you and your message, together with the payment, so that we can arrange and hold the call. Legal basis: the contract (Art. 6(1)(b) GDPR). We delete the day and your message within 12 months after the call; the payment record is kept as tax law requires (section 15).

10. Waitlists

If you join the waitlist for a programme that is coming soon, we store your name, your email address and your language, to tell you when it opens. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by writing to us. We delete the entry once we have told you, or within 12 months.

11. The teacher’s video (YouTube)

Our home page shows a video hosted on YouTube (Google Ireland Limited). It is loaded only after you click play, and in YouTube’s privacy-enhanced mode (youtube-nocookie.com). Only then does your browser connect to YouTube, which receives your IP address and may store data on your device. Legal basis: your consent, given by clicking play (Art. 6(1)(a) GDPR).

12. Contacting us

If you write to us, we use your message and your address to answer you. Our mailbox is provided by Microsoft (Microsoft Ireland Operations Limited) as part of Microsoft 365. Legal basis: the contract or steps before one (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering you (Art. 6(1)(f) GDPR).

13. Who receives your data

We work with the following providers, each bound by a data processing agreement or acting under its own responsibility as stated, and only as far as necessary:

Google Cloud (Google Cloud EMEA Limited, Dublin, Ireland) — hosting of the website, the portals and our database, on servers in Belgium.

Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland) — payments and fraud prevention.

Brevo (Sendinblue SAS, Paris, France) — sending our emails.

Google (Google Ireland Limited, Dublin, Ireland) — “Continue with Google”, Google Calendar and YouTube, each only if you use it.

Microsoft (Microsoft Ireland Operations Limited, Dublin, Ireland) — our email mailbox.

Zoom (Zoom Communications, Inc., San Jose, USA) — the live sessions and the Entry Call.

Where the law requires it, we also pass data to tax advisers and public authorities. We never sell your data.

14. International transfers

We are based in the United Kingdom, which the European Union recognises as ensuring an adequate level of data protection; our website, portals and database are hosted in the EU, in Belgium, which UK law recognises in the same way. Some of our providers, or their parent companies, may process data elsewhere, in particular in the United States. We allow this only where an adequate level of protection is ensured: by an adequacy decision — such as the EU–US Data Privacy Framework and its UK extension — or by standard contractual clauses (the EU clauses, with the UK Addendum where UK law applies). Where our own team accesses data from another country, the same safeguards apply.

15. How long we keep your data

Account data: for as long as you have an account. When you ask us to close it, we delete or anonymise your data within 30 days, except what we must keep by law.

Invoices and payment records: for the periods required by tax and company law — in the United Kingdom, six years from the end of the financial year they belong to.

Server logs: up to 30 days. Links in our emails expire after 60 minutes (password reset) or 72 hours (email confirmation).

16. Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), erased (Art. 17) or its processing restricted (Art. 18), to receive it in a portable format (Art. 20), and to object to processing based on our legitimate interests (Art. 21). You can withdraw a consent at any time, with effect for the future (Art. 7(3)). To exercise any of these rights, write to contact@useyourgerman.com.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR): in the United Kingdom, the Information Commissioner’s Office (ico.org.uk); in the European Union, in particular the authority of the country where you live or work.

17. What you must provide

To book, you need to give us your name, your email address and your payment details; without them we cannot conclude or carry out the contract. Everything else is optional.

We do not make decisions based solely on automated processing, including profiling.

18. Security

All connections are encrypted (HTTPS). Passwords are stored only as hashes, card details never reach our servers, the API keys of connected services are stored encrypted, and access to personal data is limited to those who need it.

19. Age

Our services are for adults. We do not knowingly collect data from anyone under 18; if you believe a minor has given us personal data, tell us and we will delete it.

20. Changes to this policy

We update this policy when our services or the law change. The date at the top shows the current version.