Privacy statement
This statement describes which personal data this site processes, for what and for how long. It describes only what is actually built.
Controller
The controller for this processing is the provider named in the imprint:
- Provider
- Lesly González
- Postal address
- Benediktbeurer Ring 8
86929 Penzing
Data processed, purpose, legal basis and storage period
| Data | Purpose | Legal basis | Storage period |
|---|---|---|---|
| E-mail address, password (as a hash value only), Studienkolleg, course type, examination date, language, the setting for the reminders and information by e-mail, and the moment and version of the terms accepted at registration. No name, no postal address and no date of birth are collected. | Running the account and determining the examination profile. The examination date is also used to set the end of the run time when an access code bought before the packages were introduced is redeemed, to show, in the history across several simulations, how many days away that date is, and, on the offer page while you are signed in, to suggest which package lasts until that date. That suggestion is worked out in your browser only and is not stored. The domain of the e-mail address is compared with a list of known disposable e-mail services held in the service; if it matches, texts are not graded for free without a package. No external service is asked. | Contract and steps prior to a contract, Art. 6(1)(b) GDPR. | Until the account is deleted. You trigger that deletion yourself and it takes effect at once. |
| The confirmation link for the e-mail address, stored as a hash value only, with the moment it was issued and the moment it expires. | Checking that the stated address can receive mail. | Contract, Art. 6(1)(b) GDPR. | With the account. Independently of that, a daily job removes every confirmation link at the latest 30 days after it has expired. |
| The link to a new password, if you use “Forgot your password?”: stored as a hash value only, with the moment it was issued, the moment it expires and the moment it was used. No IP address. | Letting you set a new password if you have forgotten your old one. The link goes only to the address of your account and works once. | Contract, Art. 6(1)(b) GDPR. | The link works for 60 minutes. A daily job removes it at the latest one day after it has expired, and at once with the account. |
| The session identifier in a cookie. | Keeping you signed in while you use the site. | Contract, Art. 6(1)(b) GDPR. | A session ends eight hours after its last use, and at once when you sign out. When you set a new password, all sessions of your account end at once. |
| The purchase record: the package chosen (number of months), amount, currency, the payment provider's reference, state, timestamps, the end of the run time stated when the purchase was started and the moment the loss of the right of withdrawal was confirmed, the versions of the terms and of the withdrawal notice that applied to the purchase, and the moment the booking confirmation was sent by e-mail. For the access unlocked, its first and its last day are stored. | Settling the purchase and keeping it as a commercial record. | Contract, Art. 6(1)(b) GDPR, and a legal obligation, Art. 6(1)(c) GDPR. | Deleting the account removes the account identifier from the purchase record. The record itself remains, with no link to a person. |
| The e-mail address a bought access code is sent to, and the language of that message. Nothing at all is collected about the person it is bought for. | Delivering the access code that was bought. | Contract, Art. 6(1)(b) GDPR. | This address belongs to somebody who has no account. It is currently not deleted automatically. |
| Your consent to the reminders and information by e-mail: the moment of consent, the version of the consent text, the moment you confirmed your current e-mail address through the link in the confirmation e-mail, and the moment of the last withdrawal. No IP address is stored for this. In addition, for every reminder sent, a note with its time and a hash value of the unsubscribe link. | Sending the reminders, each exactly once: one seven to fourteen days after registration and one before the examination date. On the basis of the same consent, also sending information about new products, offers and tips by e-mail. Also making it possible to unsubscribe, and being able to prove that and when you consented and confirmed your address. | Consent, Art. 6(1)(a) GDPR in conjunction with Section 7(2) no. 2 of the German Act against Unfair Competition (UWG). For keeping the proof, the legitimate interest in being able to demonstrate the consent (Art. 7(1) GDPR), Art. 6(1)(f) GDPR. | With the account. A withdrawal stops the messages at once. The moment of consent, the version of the consent text, the moment of confirmation and the moment of withdrawal are kept as proof until the account is deleted. |
| The kind of report from the mail service (permanently undeliverable, temporarily undeliverable or a complaint), a hash of the address concerned, the service's own identifier for the report and the time. The address itself is not stored. The hash does not reveal the address; somebody who already knows an address can use it to check whether that address is affected. | To measure the share of messages that come back. Above the mail service's limits it suspends the sending route — and then confirmations and access codes reach nobody either. | Legitimate interest in a working sending route, Art. 6(1)(f) GDPR. | The share is measured over the last 14 days. Older rows are currently not deleted automatically. |
| A hash of the e-mail address, the reason (permanently undeliverable or a complaint) and the time. The address itself is not stored. | Nothing further is sent to an address that keeps coming back or has complained — neither by this service nor through the mail service. | Legitimate interest in a working sending route, Art. 6(1)(f) GDPR; for a complaint also respecting your objection, Art. 21 GDPR. | Permanently, and that is the purpose: a deleted entry would allow messages to the same address again. The entry therefore outlives the deletion of an account. It often belongs to an address that belongs to no account at all. |
| The result record of a completed simulation: the examination profile with its revision, and for every exercise version that was shown the examination part, the exercise type, the points achieved and achievable, and whether it was assessed without a language model, together with the start and end of the simulation and the moment the result was recorded. The only identifier of a person on it is a pseudonymous participant identifier, never an account identifier. Your answers, your free texts and the reasons given for an assessment are not part of it. | Showing where you stand after a simulation, building the history across several simulations, and computing how you compare with other applicants. The operator area does not read this dataset: the standing per examination part the provider sees there is formed from your practice sessions alone. The comparison is formed from aggregate figures only; no single result of another person is ever shown. A comparison is only formed once at least 15 other applicants have a result of the same examination profile in the same revision, and each of them counts with exactly one result; a statement about the outcome of the real examination only from 50 other applicants and at least 15 reports. That does not make such a figure fully anonymous: it is formed anew on every request, and anyone who requests the same comparison over a longer period or with several results of their own can infer the score of individual other results from the differences. That is why the minimum figures are not lowered and individual scores are never named. | Contract, Art. 6(1)(b) GDPR, as far as showing your own result is concerned; for the comparison with other applicants, the legitimate interest in a sound basis for comparison, Art. 6(1)(f) GDPR. | Permanently, and that is the purpose: the record outlives the deletion of an account. The deletion removes the link between the account and the participant identifier; from this service's own data the record can then no longer be attributed to a person, and it remains in the basis for comparison as a score. A pseudonymous identifier is not the same as an anonymous one: anyone holding further data — access logs with a time and an IP address, for instance — could infer a person from an examination profile with very few participants. That is why the access logs are kept only for the period stated below. The end of a package's run time does not end readability: results, gap analyses and the history stay available afterwards. With the mapping row the history goes, because it is formed from the attempts of that account; the scores themselves remain. |
| Whether the real examination was passed, together with the examination profile and the revision your last result was formed against. This entry is stored without an account identifier, without a participant identifier and without a point in time. All that is noted on your account is that feedback was given — never how it turned out. In addition there is a dispatch note for the request and for the at most one reminder, carrying the hash of the link the answer is given over. | To form the pass statement of the position report. It is formed only once at least 50 other applicants have a result of the same examination profile in the same revision and at least 15 reports are present; what is named is the number of reports and how many of them were a pass, never anything about an individual. Such a figure is therefore not fully anonymous: it is formed afresh on every request, and somebody reading the same page before and after one further report can infer the outcome of that one report from the difference. The minimum figures are therefore not lowered. | Consent, Art. 6(1)(a) GDPR. The feedback is voluntary, and submitting one of the buttons is the consent. There is no disadvantage in giving none: no block and no restriction. Nothing is stored until a button is submitted — opening the link changes nothing — and you can leave the question unanswered or choose the button that gives no feedback. After it is submitted the entry can no longer be found and no longer be deleted: it carries no identifier of you and no point in time, so it cannot be attributed to a person by us. A withdrawal for the future therefore has nothing to act on — nothing further about you is processed, and after your answer we do not write to you about this question again. For the dispatch note of the request: contract, Art. 6(1)(b) GDPR; it goes with the account. | Permanently, and that is the purpose: the entry outlives the deletion of the account, because it forms the comparison basis of every other applicant and a deletion would otherwise shrink that basis. The note on your account and the dispatch note go with the account. The entry itself cannot be attributed to a person: it carries no identifier and no point in time, and its own key is a random number rather than a timestamp. |
| Aggregate counts over account, training and access rows that already exist: how many registrations were confirmed in a period, how many of those spent at least one practice session of the trial, and how many of those obtained an access. Nothing but counting happens; no e-mail address, no account identifier and no individual row is read or given out. No new column and no new table is created for it. | Reading off whether the trial leads to an access. Without these three counts there is no way to judge whether the only planned sales channel carries. | Legitimate interest in judging and developing our own offer, Art. 6 (1) (f) GDPR. | No storage of its own: the counts are produced afresh on every run and travel only as numbers in an operational message to the provider. Deleted accounts do not count, so the numbers are lower bounds. |
| When signing in, registering, confirming the e-mail address, using ‘forgot password’, buying and redeeming an access code: the IP address of the request, only as an encrypted hash and only in the server's memory, with the number of attempts. | Slowing down repeated attempts from the same place (at most five in 15 minutes), so that accounts, mailboxes and the service are protected against abuse. | Legitimate interest in secure operation and in preventing abuse, Art. 6(1)(f) GDPR. | At most 15 minutes after the last counted attempt, immediately on a restart of the server. Not in a database and not in a log. |
| The data of an account the provider sees in the operator area: e-mail address, customer number, Studienkolleg, course type, examination date, whether the e-mail address is confirmed, the moment of registration, the practice sessions of the trial that were used and that were credited, packages and purchases with their run time, route (direct, access code or goodwill) and amount, the standing per examination part formed from your practice sessions, the number of your practice sessions and simulations, and a timeline of these events. Nothing new is collected about your use of the site for this: all of it comes from the data described in this table. The only things newly stored are the customer number and, in the two rows below, notes, credits and the access log. The customer number is a number that is formed from nothing about you and is not the internal identifier of your account. | Answering requests about your account, tracing purchases and access, sending a confirmation link again, granting credits and judging the offer as a whole. For the overview and the sales, figures across all accounts are formed for this, such as registrations and purchases per week. The overview also names the latest registrations (with Studienkolleg and course type), purchases and activities one by one, each with the customer number and the part of the e-mail address before the @ sign. Opening the overview is not written to the access log, as it is not a customer page; opening a customer page is. | Contract, Art. 6(1)(b) GDPR, as far as your account, your access and your requests are concerned; otherwise the legitimate interest in looking after customers and in judging our own offer, Art. 6(1)(f) GDPR. | The view itself is not stored: it is formed on every request from the data of the other rows, and their storage periods apply. The customer number exists until the account is deleted. After that the account no longer appears in the operator area; a purchase record that remains is listed in the sales without a customer number. |
| Internal notes of the provider about an account in the operator area (text up to 2000 characters, moment, author) and credits, each with its moment and author: a package credited as goodwill, with its run time and reason, or additional practice sessions of the trial. Also every deactivation and reactivation of a package, for instance after a refund, with its moment, author, reason (refund or other) and an optional note. Also every mark of a sale as refunded in the sales list and its removal, with its moment, author and an optional note. | Looking after requests about an account in a traceable way and keeping a record of credits. A goodwill credit is not paid for and counts as €0.00 in every total. The note field is not meant for health or payment data; a notice saying so stands beside the field. Notes are not exported. | Contract, Art. 6(1)(b) GDPR, as far as a note or a credit concerns your access or your request; otherwise the legitimate interest in traceable customer care, Art. 6(1)(f) GDPR. | Until the account is deleted. Deleting the account deletes the notes and the reason and author of every credit, and every deactivation and reactivation of a package. If a package was deactivated because of a refund, only the remark “refunded” with its moment and author stays on the purchase line, without a note. A mark of a sale as refunded belongs to the purchase line and stays as long as it does. |
| The access log of the operator area: who accessed (the provider's sign-in), when, what happened (customer page opened, sales exported, note added, credit granted, confirmation link sent again, package deactivated or reactivated, sale marked as refunded or mark removed) and the customer number of the account concerned, none for an export of the sales or a mark on a sale. The log contains no IP address, no e-mail address and nothing of the content of the page opened. | Tracing who accessed the data of an account and when, and recognising an unauthorised access. The log arises only from actions in the operator area, never from your use of the site. | Legitimate interest in controlling access to customer data, Art. 6(1)(f) GDPR. | 90 days. After that a daily job deletes every entry automatically. The entries about an account are deleted at once with the account. |
| A short message to the provider's mailbox for every registration, every booking (purchase or redemption of an access code) and every report of an error in an exercise: customer number and time, for a registration and a booking also the Studienkolleg and the course type, for a booking the package, the amount and the route (direct or access code), for a report the exercise type, whether practice or simulation, and the kind of report. The message contains no e-mail address, no name and not the text of a report. No message goes out for a goodwill package, which the provider grants themselves. | Noticing new customers and bookings promptly and being able to answer questions about them without having to sign in to the operator area every time. | Legitimate interest in looking after customers promptly, Art. 6(1)(f) GDPR. | The message stays in the provider's mailbox until they delete it. There is no automatic deletion there. The customer number can be linked to an account only in the operator area and only as long as the account exists. |
| A report of an error in an exercise, when you use “Report an error” under a result: the kind of report, if you choose, the part of the exercise it concerns, your text (up to 1,000 characters), the language of the page, the time, and the exercise, its version and the practice session or simulation the report refers to. With it the provider sees your answer and the grading of this exercise in the operator area. Also stored with the report: whether and when the provider dealt with it, and an internal note. | Finding and fixing errors in exercises and gradings. It does not come with a personal reply or a change to your points. | Contract, Art. 6(1)(b) GDPR, as far as the correct grading of your own exercises is concerned; otherwise the legitimate interest in exercises and gradings without errors, Art. 6(1)(f) GDPR. Reporting is voluntary. | Until the account is deleted. Deleting the account deletes all reports at once. |
| Server access logs: IP address, moment, requested address and browser identification. | Operating the service, finding faults and defending against abuse. | Legitimate interest in secure operation, Art. 6(1)(f) GDPR. | How long access logs are kept: 180 Tage |
Operator area: customers and sales
The three rows about the operator area in the table above describe what the provider sees and records there about accounts. Only the provider has access, signed in to the operator area; whether a sign-in is entitled to it is decided by the server on every request. Every opening of a customer page or of a report about an exercise, every export and every action on an account is in the access log. No data is passed on to third parties from the operator area; a confirmation link sent again goes through the mail service like every other message.
A customer list cannot be exported. The only list that can be downloaded as a file is the list of sales, with customer number, date, package, route, state and amount, and without an e-mail address. It serves bookkeeping and the evaluation of sales. The customer number is formed from nothing about the person; it can be matched to an account only in the operator area and only as long as the account exists. Every export is logged.
For every registration, every booking and every report of an error in an exercise the provider receives a short e-mail to their own mailbox, with customer number and time, for a registration and a booking with Studienkolleg and course type, for a booking with package, amount and route, for a report with the exercise type and the kind of report — never with your e-mail address and never with the text of a report. It goes through the mail service like every other message; the row for it is in the table above.
Deleting the account also deletes the notes, the reason of every credit, the reports about exercises and the entries of the access log about that account. After that the account no longer appears in the operator area. The pseudonymous result record remains, as described above.
How long purchase records are kept
The following period applies to purchase records under commercial and tax law:
10 Jahre nach § 147 AO
Deleting the account
You can delete your account yourself at any time. The deletion cannot be undone and takes effect at once: the account, the link to the pseudonymous participant identifier, the confirmation links and the dispatch notes are removed; a running package and any follow-on packages booked ahead are deleted with the account and lapse without replacement; so are the provider's notes, the reason of every credit, your reports about exercises and the entries of the access log about that account. Purchase records remain as commercial records and lose their link to the account. An access code that has been redeemed stays redeemed and loses the identifier of whoever redeemed it. The entry on the suppression list and the mail service's reports do remain: both carry only a hash of the address, and a deleted suppression entry would allow messages again to an address that keeps coming back. The pseudonymous result record of a completed simulation also remains: it carries no account identifier, and with the link removed it can no longer be attributed to a person from this service's own data.
Reminders and information by e-mail
At registration, the box for the reminders and information by e-mail is not ticked. Only those who tick it themselves, or switch the e-mails on later in the account, consent. The consent covers reminders about the examination date and information about new products, offers and tips. Sign-up uses the double opt-in procedure: we only write once you have confirmed your e-mail address through the link in our confirmation e-mail; if you change the address, the same applies again to the new address. As proof we store the moment of consent, the version of the consent text and the moment of confirmation, but no IP address. At present at most two reminders go out, each exactly once: one seven to fourteen days after registration, if nothing has been booked by then, and one before the examination date on file, if no valid package exists at that moment. Both point to the packages. The e-mails are sent through the e-mail service named in this statement (Amazon SES). We do not measure whether or when you open an e-mail or click a link in it: the e-mails contain no tracking pixel, the logo is the same image file for every recipient, and links are not redirected to count clicks. The consent can be withdrawn at any time with effect for the future: through the unsubscribe link at the end of each of these e-mails or through the switch in the account. Both take effect at once, for all of these e-mails and without the operator doing anything. The lawfulness of the processing carried out before the withdrawal is not affected.
Processors
These services process data on behalf of the provider. For each of them, the place where data is processed is stated.
| Service | Provider | Where data is processed |
|---|---|---|
| Sending e-mail | Amazon SES | eu-central-1, Frankfurt am Main, Germany |
| Payment processing | Stripe Payments Europe, Ltd. Dublin, Irland | Europäische Union; Übermittlung in die USA an Stripe, Inc. auf Grundlage der EU-Standardvertragsklauseln |
| Grading free text | Anthropic Ireland, Limited Dublin, Irland | Vereinigte Staaten. Eine Verarbeitung in der EU bietet der Dienst nicht an; die Übermittlung erfolgt auf Grundlage der Standardvertragsklauseln im Auftragsverarbeitungsvertrag nach Art. 46 Abs. 2 lit. c DSGVO. |
| Hosting the application | Hetzner Online GmbH | Nürnberg, Deutschland (Hetzner Online GmbH) |
| Backup storage | Cloudflare R2 | Europäische Union (Bucket mit EU-Jurisdiktion) |
A backup is encrypted on the server before it leaves it.
Grading model
Free text is graded by a language model. What is passed on is the exercise, the model answer, the scoring scheme and the text you wrote — and nothing else: neither your e-mail address nor any identifier of your account leaves the server. The provider processes the data as a processor, does not use it to train its own models and, by its own statement, stores it for 30 days, or for up to two years where a safety review flags it. Processing takes place in the United States; the service does not offer processing within the EU. The transfer rests on the standard contractual clauses in the data processing addendum. On the exercise page of a free-text exercise, the notice about this transfer stands above the answer field, before the first character is written. The justification of a point decision does not quote from your text; one that did is discarded and never stored.
Cookies
Only technically necessary cookies are set: the session cookie of the sign-in, and short-lived cookies that carry a refused entry across a redirect and expire after five minutes. There is no analytics, no tracking, no consent management and no typeface loaded from a foreign server. There is therefore nothing to consent to.
Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection. Please write to the contact address named in the imprint.
Complaint to a supervisory authority
You can lodge a complaint with a data protection supervisory authority. The competent one is:
entfällt (keine erlaubnispflichtige Tätigkeit)
The German version of these texts is the legally binding one. This English version is a translation and is provided for information only.
As of: 31.10.2026