Hi and welcome to our privacy policy!
We have tried to explain everything as precisely, transparently, clearly and understandably as possible, so that you can immediately see what happens to your data.
First things first: Data protection is very important to us, which is why we care about handling your data correctly and keeping it secure at all times.
If, despite our efforts, you feel that we are not handling something the way you would like, you can write to our support team at any time and we will take care of it right away.
We are required by law to provide you with an understandable privacy policy. We would do that anyway, because it matters to us personally.
At the same time, there are authorities that keep an eye out for companies that have not implemented their privacy policy correctly. These authorities read our privacy policy too. That is why you will often see references to legal provisions here, which we use to officially show that we are allowed to do what we do.
So don't be surprised: this privacy policy is of course meant first and foremost to inform you. At the same time, we have to comply with legal requirements, which is why there are legal notes here and there.
But now, enjoy reading and, above all, good luck with your next exam!
Your simpleclub team
In most cases, the controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection provisions is us, namely
simpleclub GmbH
Lena-Christ-Straße 2
D-82031 Grünwald
Germany
You can reach us as follows:
Email: support@simpleclub.com
Phone: +49 15735981999
However, there may also be cases in which we act solely on behalf of another company or organisation and process your data for them. For example, if you use simpleclub through your company or your school, we are merely a so-called processor in these cases, and the controller is the company that employs you or your school or the school authority.
Our data protection officer is provided by Proliance GmbH. You can reach them as follows:
Proliance GmbH
Data Protection Officer simpleclub
Leopoldstr. 21
80802 München
Germany
Email: datenschutzbeauftragter@datenschutzexperte.de
Data protection is not a simple topic and can sometimes be a little hard to understand. To help you fully understand our privacy policy, you can find the official definitions from the General Data Protection Regulation (GDPR) here. So if you ever come across a word you don't understand, you can simply look it up via the link.
In accordance with Art. 13 GDPR, we inform you of the legal bases of our data processing. Unless the legal basis is specifically stated in the privacy policy, the following applies:
The legal basis for obtaining consent is Art. 6(1)(a) in conjunction with Art. 7 GDPR. The legal basis for processing for the performance of our services and the implementation of contractual measures, as well as for responding to enquiries, is Art. 6(1)(b) GDPR. The legal basis for processing for compliance with our legal obligations is Art. 6(1)(c) GDPR. If the processing of your data is necessary for the purposes of our legitimate interests and the interests or fundamental rights and freedoms of the data subject (that's you) do not override the first-mentioned interest, Art. 6(1)(f) GDPR serves as the legal basis for the processing.
Important: If you use simpleclub through your school, it is not possible for you to consent to any optional processing. This means that all processing described in this privacy policy that is based on consent pursuant to Art. 6(1)(a) GDPR is not relevant to you, and this processing of your data is not possible at all. In this way, your data is only processed to the extent strictly necessary to provide our service. If you use simpleclub through your training company, this may also apply to you if your training company has asked us to do so.
As a general rule, we only store your data so that you can make the best possible use of simpleclub. For example, we store your grade level so that we can show you the content from the whole simpleclub world that is relevant to you. Of course, we don't simply store your data forever. There are statutory retention periods (e.g. under commercial and tax law) that we comply with. Once the respective period has expired, the corresponding data is routinely erased.
If data is necessary for the performance of a contract or for pre-contractual measures, or if we have a legitimate interest in continuing to store it, the data will be erased once it is no longer necessary for these purposes or once you have exercised your right to withdraw consent or your right to object.
As a data subject within the meaning of the GDPR, you can exercise various rights. The data subject rights arising from the GDPR are the right of access (Article 15), the right to rectification (Article 16), the right to erasure (Article 17), the right to restriction of processing (Article 18), the right to object (Article 21), the right to lodge a complaint with a supervisory authority and the right to data portability (Article 20).
Some data processing can only take place with your explicit consent. You can withdraw the consent you have given at any time. However, the withdrawal does not affect the lawfulness of the processing carried out before the withdrawal.
If the processing is based on Art. 6(1)(e) or (f) GDPR, you as the data subject have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you. This right also applies to profiling within the meaning of Art. 4(4) GDPR based on these provisions (even though we don't do anything like that). Unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims, we will no longer process your data once you have objected.
If personal data is processed for direct marketing purposes, you also have the right to object at any time. The same applies to profiling to the extent that it is related to direct marketing. Here, too, we will no longer process personal data as soon as you object.
If you believe that the processing of personal data concerning you infringes the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, without prejudice to any other administrative or judicial remedy.
If your data is processed by automated means on the basis of consent or the performance of a contract, you have the right to receive this data in a structured, commonly used and machine-readable format. You also have the right to request that the data be transmitted and made available to another controller, where technically feasible.
You have the right to obtain information about your processed personal data regarding the purpose of the processing, the categories, the recipients and the storage period. If you have any questions on this topic or other topics relating to personal data, you are of course welcome to contact us using the contact details provided.
You can request the restriction of the processing of your personal data at any time. To do so, one of the following conditions must be met:
Where processing has been restricted, the personal data may, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
Of course we pass your data on to the NSA. – Just kidding :D
As a general rule, we do not transfer your personal data to third parties, except
This list is the official wording we have to use. What we can tell you is that we will never use your data in any way other than you want without your consent (as long as we have a choice or it cannot be avoided). If you have any questions about this section, just write to our support team and we will answer everything for you.
Our website and our app also include tools from companies based in third countries (e.g. the USA). If these tools are active, your personal data may be transferred to the servers of the respective companies. Even though the level of data protection in third countries generally does not correspond to EU data protection law, we always take appropriate measures to make the processing secure for you.
This website and our app may contain links to third-party websites or to other websites for which we are responsible. If you follow a link to one of the websites outside our responsibility, please note that these websites have their own privacy policies. We accept no responsibility or liability for these third-party websites and their privacy policies. Before using these websites, please therefore check whether you agree with their privacy policies.
You can usually recognise external links because they are shown in a slightly different colour from the rest of the text or are underlined. Your cursor usually indicates an external link when you move it over such a link. Your personal data is only transferred to the link target when you click on an external link. In particular, the operator of the other website receives your IP address, the time at which you clicked the link, the page on which you clicked the link and other information that you can find in the privacy policy of the respective provider.
Please also note that individual links may lead to data being transferred outside the European Economic Area. As a result, foreign authorities could gain access to your data. You may not have any legal remedies against such access. If you do not want your personal data to be transferred to the link target or to be exposed to unwanted access by foreign authorities, please do not click on any links.
External services are used on our website and in our app. External services are services from third-party providers that we use. This can be for various reasons, for example to embed videos or for the security of the website/app. When these services are used, personal data is also disclosed to the respective providers of these external services. If we do not have a legitimate interest in using these services, or their use is not necessary for the fulfilment of our contractual or legal obligations, we obtain your consent, which you can withdraw at any time, as a visitor to our website or as a user of our service before they are used (Art. 6(1)(a) GDPR).
Our website/app uses local storage items, session storage items and/or cookies. Local storage is a mechanism that allows data to be stored within the browser on your device. This data usually contains user preferences, such as the "day" or "night mode" of a website, and is retained until you delete the data manually. Session storage is very similar to local storage, except that the data is only stored for the duration of the current session, i.e. until the current tab is closed. After that, the session storage items are deleted from your device. Cookies are pieces of information that a web server (a server that provides web content) places on your device, for example in order to be able to identify that device. They are stored on your device either temporarily for the duration of a session (session cookies) and deleted at the end of your visit to a website, or permanently (persistent cookies) until you delete them yourself or your web browser deletes them automatically.
These objects can also be stored on your device by third-party companies when you use our site/app (third-party requests). This enables us as the operator and you as the visitor/user to use certain services from third parties that are installed on this website or in our app. Examples include the processing of payment services or the display of videos.
These mechanisms have a wide range of uses. They can improve the functionality of a website, control shopping cart functions, increase the security and convenience of using the website, and carry out analyses of visitor flows and behaviour. Depending on their individual functions, they are to be classified differently under data protection law. If they are necessary for the operation of the website and intended to provide certain functions (shopping cart function), or serve to optimise the website (e.g. cookies for measuring visitor behaviour), they are used on the basis of Art. 6(1)(f) GDPR. As the operator, we have a legitimate interest in storing local storage items, session storage items and cookies for the technically error-free and optimised provision of our services or in the context of fulfilling our contractual obligations. In all other cases, local storage items, session storage items and cookies are only stored with your explicit consent (Art. 6(1)(a) GDPR).
Where local storage items, session storage items or cookies are used by third-party companies or for analytics purposes, we will inform you of this separately in this privacy policy. Your required consent will be requested and can be withdrawn at any time.
We reserve the right to amend or update this privacy policy where necessary in compliance with the applicable data protection provisions.
This allows us to adapt it to current legal requirements and to take into account changes to our services, e.g. when introducing new services. The current version applies to your visit.
Our service is hosted by:
Google Cloud Platform of Google Cloud EMEA Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA.
When you use our website or our app, we automatically collect and store information in so-called server log files. Your browser or your device automatically transmits this information to our server or to the server of our hosting provider.
This includes:
In the simpleclub app, we additionally collect the following data:
This data is not combined with other data sources.
Instead of running this website on our own server, we may also have it run on the server of an external service provider (hosting provider), which we have named above in that case. The personal data collected by our website/app is then stored on the hosting provider's servers. In addition to the data mentioned above, the hosting provider also stores, for example, contact requests, contact details, names, website access data, meta and communication data, contract data and other data generated via a website on our behalf.
The legal basis for the processing of this data is Art. 6(1)(f) GDPR. Our legitimate interest is the technically error-free presentation and optimisation of this website and our app. If the website or app is used to enter into contract negotiations with us, to conclude a contract or to use a contractual service, Art. 6(1)(b) GDPR serves as an additional legal basis. Where we have engaged a hosting provider, we have concluded a data processing agreement with this service provider.
For reasons of technical security, in particular to defend against attempted attacks on our web server, we may store this data for a short period. Neither we nor the hosting provider used can directly identify individual persons on the basis of this data.
You can generally learn with our website and app without a user account.
In doing so, we optionally collect the following data:
We need this information to tailor the app to your learning plan and show you the right content.
We also store which content you have learned and when during use. For example, which videos you watch and which exercises you get right or wrong. Without this information, we would not be able to deliver our learning content in a meaningful way. And then you wouldn't be able to use simpleclub properly.
What is important to us here is that you know that, as a general rule, we will not disclose data about your learning progress to third parties! Except with your consent in the context of the trainer or teacher profile, as described further below.
If you are interested in the legal bases for this, you can find them in the GDPR under Art. 6(1)(b) GDPR for the performance of a contract and under Art. 6(1)(f) GDPR on the basis of our legitimate interest. Our legitimate interest here is the provision of our online service.
You can also create a user account on the website and in the app. We need this so that you can, for example, use simpleclub on several devices or to make sure that your learning progress is not lost if you uninstall the app.
Please note that we need your parents' consent for registration if you are not yet 16 years old. Otherwise, we cannot process your details and cannot allow you to register.
During registration, we additionally collect the following data:
The processing of this data is necessary for you to be able to use simpleclub at all.
If you are interested in the legal bases for this, you can find them in the GDPR under Art. 6(1)(b) GDPR for the performance of a contract and under Art. 6(1)(f) GDPR on the basis of our legitimate interest. Our legitimate interest here is the provision of our online service.
Your data will be erased as soon as the user account on our website is deleted, provided there are no statutory retention obligations. You can change your data or delete your user account completely. You can easily find the function for this in your profile. If you have any problems with this, you can write to our support team at any time and we will carry out your request without undue delay.
We offer you the option of signing up for our service with Google. Please note that by clicking the button you give your consent. This allows us to offer you quick registration or login. If you are interested in the legal basis, you can find it under Art. 6(1)(a) GDPR. A separate registration is therefore not necessary. To sign in, you will be redirected to Google's page, where you can log in with your user credentials. This links your Google profile and our service. Through this link, Google LLC automatically transmits the following information to us:
Of this data, we only use your name, your email address and the link to your profile picture. This information is strictly necessary for concluding the contract in order to be able to identify you.
For more information on Google Sign-In and the privacy settings, please refer to the privacy policy and the terms of service of Google LLC.
The use of the service may result in data being transferred to a third country (USA). The provider is certified under the EU-U.S. Data Privacy Framework and therefore offers an adequate level of data protection.
This section applies to users of the app who use the app as apprentices of a training company or as pupils of a school or other educational institution that has concluded a contract with us for this purpose.
If you are assigned to a learning plan, join a learning plan or complete a test, your teacher can view your learning progress and your test results related to the learning plan or test. In addition, global reports may be available to your trainer if these are used by your organisation. We ensure that this data is not used for any other purposes. You can contact us at any time if you have any questions or wish to object to the processing of your data.
If you write to us by email or contact our support team, your details and the contact details you provide will be stored. We do this in order to handle your enquiry and to be available for any follow-up questions. We will never disclose this data without your consent. From a legal point of view, we are allowed to do this because we have a legitimate interest in responding to your request.
The legal basis for this can therefore be found in the GDPR under Art. 6(1)(f) GDPR and under Art. 6(1)(b) GDPR if the enquiry is aimed at concluding a contract or is related to the fulfilment of contractual obligations.
Your data will be erased once your enquiry has been fully handled, unless there are statutory retention obligations.
Some of the functions we offer within the simpleclub services are based on your interaction with the application. This means that we record and evaluate your interactions with the application in pseudonymised form. Among other things, this concerns the algorithm for recommending content, which suggests further suitable topics to you based on the way you use simpleclub. If you use simpleclub as an apprentice of a training company or as a pupil of a school or other educational institution, we may provide your trainer/teacher with corresponding reports based on your learning progress and other interactions with the application, so that they can support you in the best possible way.
This processing is based on Art. 6(1)(b) GDPR, i.e. for the due performance of our contract.
If you want to receive our newsletter, we need your email address as mandatory information. Obviously, otherwise we can't send you an email #captainobvious :D
We also store the IP address from which you subscribed to the newsletter, as well as the date and time of the subscription. We do this so that we can prove that you subscribed voluntarily and that it wasn't someone else pretending to be you.
To be sure that you really want to receive our newsletter, we use the so-called double opt-in procedure.
This means that we only send you our newsletter by email once you have explicitly confirmed to us that you want to receive our newsletter. To do this, we first send you an email with a link that you can use to confirm that you are actually the owner of the email address that was used to subscribe to the newsletter.
By doing so, you give us your consent to use your email address for sending the newsletter. We store this consent together with the date and time at which you gave it.
(If you are interested in the legal basis, you can find it in the GDPR under Art. 6(1)(a) GDPR.)
Our email newsletters are sent via a technical service provider to whom we disclose the data you provided when subscribing to the newsletter. We have concluded a data processing agreement with our email service provider in which we oblige it to protect our customers' data and not to disclose it to third parties.
(A little legal note: the use of these services may result in data being transferred to a third country (USA). The providers are certified under the EU-U.S. Data Privacy Framework and therefore offer an adequate level of data protection.)
Of course, you can unsubscribe from the newsletter at any time. You can do this either via the link at the very bottom of every email we send you, or by writing to our support team and letting us know that you no longer want to receive emails from us.
After you unsubscribe, we will remove your email address from our newsletter mailing list without undue delay, unless you have given us your consent to continue using your data or the processing is otherwise still permitted by law.
In this section, we show you which tools, technologies and services we use to provide or further improve the functions of our website and app. Since these tools also process data, we want to explain to you exactly what these tools do and why we use them. Because we operate more than one website, we have broken this down a little for your understanding. By "website" we mean the following websites:
So this does not include our simpleclub application, which you use to learn or manage your account. We only mean our learning app when we talk about the application or app. The simpleclub application is available via the smartphone app (Android or iOS) or via the web (https://app.simpleclub.com). The websites https://admin.simpleclub.com, https://id.simpleclub.com and https://account.simpleclub.com are also part of the app. By service, we mean everything that simpleclub offers.
Hosting means the provision of web space (or other server storage) and the files located on it by a hosting provider.
This involves the transfer and storage of personal data on the hosting provider's servers. In particular, the IP addresses, meta and communication data of users and data about website access are processed. When a website visitor accesses the site, a connection is established to the web hosting provider's servers. This involves the processing of personal data of the website visitor.
We base this processing on a legitimate interest (Art. 6(1)(f) GDPR).
Our legitimate interest is to be able to present our website/app and make it available on the internet.
We use the Webflow Hosting service for our website. The provider of the service is Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA.
The use of the service may result in data being transferred to a third country (USA). The provider is certified under the EU-U.S. Data Privacy Framework and therefore offers an adequate level of data protection.
Further information can be found in the provider's privacy policy at the following URL: https://webflow.com/legal/eu-privacy-policy.
We use the Lovable service for our service. The provider of the service is Lovable Labs Incorporated, 1111B South Governors Avenue, Dover, DE 19904, USA. The use of the service may result in data being transferred to a third country (USA). The data transfer is based on the standard contractual clauses of the EU Commission.
Further information can be found in the provider's privacy policy at the following URL: https://lovable.dev/privacy.
We use the Google Cloud Platform (GCP) service for our service. The provider of the service is Google Cloud Platform of Google Cloud EMEA Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The use of the service may result in data being transferred to a third country (USA). The provider is certified under the EU-U.S. Data Privacy Framework and therefore offers an adequate level of data protection.
Further information can be found in the provider's privacy policy at the following URL: https://cloud.google.com/terms/cloud-privacy-notice?hl=de.
For our app, we use the cloud service Google Firebase from the provider Google Cloud EMEA Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The use of the service may result in data being transferred to a third country (USA). The provider is certified under the EU-U.S. Data Privacy Framework and therefore offers an adequate level of data protection.
Further information can be found in the provider's privacy policy at the following URL: https://firebase.google.com/support/privacy?hl=de
We use a content delivery network (CDN) to optimise the performance and availability of our services. For this purpose, the service provider that provides this network processes your IP address and information about when you used our services. All further information on data processing by this service provider can be found in its privacy policy.
We base this processing on our legitimate interest (Art. 6(1)(f) GDPR).
Our legitimate interest in using a content delivery network is to be able to present our services as quickly, securely and reliably as possible.
We use the Cloudflare service on our website. The provider of the service is Cloudflare Germany GmbH, Rosental 7, 80331 München, Germany.
The use of the service may result in data being transferred to a third country (USA). The provider is certified under the EU-U.S. Data Privacy Framework and therefore offers an adequate level of data protection.
Further information can be found in the provider's privacy policy at the following URL: https://www.cloudflare.com/privacypolicy/.
In order to comply with data protection requirements, we use a consent management tool on our website. We use this tool to obtain the necessary consent for setting cookies or using external services. The consents are stored.
The processing is necessary for compliance with a legal obligation to which the controller (operator of the website) is subject. Art. 6(1)(c) GDPR is therefore used as the legal basis for the processing.
We use the Usercentrics service on our website. The provider of the service is Usercentrics GmbH, Sendlinger Straße 7, 80331 München, Germany.
Further information can be found in the provider's privacy policy at the following URL: https://usercentrics.com/de/datenschutzerklaerung.
In order to manage our customer relationships better, we use customer relationship management systems. These make it possible to present customer relationship processes clearly and maintain them in an organised way. This covers both existing and potential customers. In the process, personal data such as name and address are processed.
Processing only takes place if you consent to this data processing (via our consent banner on the website or in the app). The legal basis for this processing is consent (Art. 6(1)(a) GDPR). Without your consent, the data processing described above does not take place. If you withdraw your consent, we will stop this data processing. The lawfulness of the processing carried out before the withdrawal remains unaffected.
We use the HubSpot service on our website. The provider of the service is HubSpot Ireland Limited, 1 Sir John Rogerson's Quay, Dublin 2, Ireland.
The use of the service may result in data being transferred to a third country (USA). The provider is certified under the EU-U.S. Data Privacy Framework and therefore offers an adequate level of data protection.
Further information can be found in the provider's privacy policy at the following URL: https://legal.hubspot.com/privacy-policy.
We use the HubSpot Forms service on our website. The provider of the service is HubSpot Ireland Limited, 1 Sir John Rogerson's Quay, Dublin 2, Ireland.
The use of the service may result in data being transferred to a third country (USA). The provider is certified under the EU-U.S. Data Privacy Framework and therefore offers an adequate level of data protection.
Further information can be found in the provider's privacy policy at the following URL: https://legal.hubspot.com/privacy-policy.
In order to manage our support requests better, we use tools that specialise in handling support requests. These make it possible to present support requests clearly and maintain them in an organised way. This covers existing customers. In the process, personal data such as email address, name and address are processed.
We process support requests for the purpose of performing the contract pursuant to Art. 6(1)(b) GDPR. In addition, there may be a legitimate interest in maintaining business relationships or in responding to your enquiry for other reasons.
In our app, we use the support tool Intercom from the provider Intercom R&D Unlimited Company, 2nd Floor, Stephen Court, 18-21 Saint Stephen's Green, Dublin 2, Ireland.
The use of the service may result in data being transferred to a third country (USA). The provider is certified under the EU-U.S. Data Privacy Framework and therefore offers an adequate level of data protection.
You can find details on the processing by Intercom here:
As part of our support tools, we use Loom for video hosting in order to provide explanatory videos in the help centre. The provider is Loom, Inc., 140 2nd St Fl 6, San Francisco, CA 94105, USA.
The use of the service may result in data being transferred to a third country (USA). The provider is certified under the EU-U.S. Data Privacy Framework and therefore offers an adequate level of data protection.
You can find details on the processing by Loom here: https://www.atlassian.com/legal/privacy-policy#what-this-policy-covers
Business processes run more cost-effectively, faster and with fewer errors when they are automated with the help of software via interfaces. This allows them to be integrated efficiently into company processes via the company's own website. We use interface software on our website and in our app to connect different applications with each other and to transfer personal data securely from one application to another.
The processing is based on our legitimate interest in offering our services as well as possible and providing the user with an error-free experience. The legal basis is Art. 6(1)(f) GDPR.
We use the Google Tag Manager service on our website. The provider of the service is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
The use of the service may result in data being transferred to a third country (USA). The provider is certified under the EU-U.S. Data Privacy Framework and therefore offers an adequate level of data protection.
Further information can be found in the provider's privacy policy at the following URL: https://policies.google.com/privacy.
In our app, we use the services of Ory to offer single sign-on (SSO) and multi-factor authentication (MFA). The provider of the service is Ory Corp, 132-A Veterans Lane, Suite 128, Doylestown, PA 18901, USA.
The use of the service may result in data being transferred to a third country (USA). The provider is certified under the EU-U.S. Data Privacy Framework and therefore offers an adequate level of data protection. Processing only takes place if you use SSO or MFA. Ory is not used for SSO with Google.
Further information can be found in the provider's privacy policy at the following URL: https://www.ory.sh/privacy/
To analyse user behaviour, we process personal data of website visitors and app users. By evaluating the data obtained, we are able to compile information about the use of the individual components of our services. This allows us to improve the user-friendliness of our website. The analytics tools used could, for example, be used to create user profiles for displaying targeted or interest-based advertising messages, recognise our website visitors on their next visit to our website, measure their click/scroll behaviour and their downloads, create heatmaps, record page views, measure the length of visits or bounce rates, and trace the origin of website visitors (city, country, which page the visitor comes from). With the help of the analytics tools, we can improve our market research and marketing activities.
Processing only takes place if you consent to this data processing (via our consent banner on the website). The legal basis for this processing is consent (Art. 6(1)(a) GDPR). Without your consent, the data processing described above does not take place. If you withdraw your consent (e.g. via the consent banner or other options provided on this website), we will stop this data processing. The lawfulness of the processing carried out before the withdrawal remains unaffected.
We use the Google Analytics service on our website. The provider of the service is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
The use of the service may result in data being transferred to a third country (USA). The provider is certified under the EU-U.S. Data Privacy Framework and therefore offers an adequate level of data protection.
Further information can be found in the provider's privacy policy at the following URL: https://policies.google.com/privacy.
We use the LinkedIn Insight Tag service on our website. The provider of the service is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.
The use of the service may result in data being transferred to a third country (USA).
Further information can be found in the provider's privacy policy at the following URL: https://www.linkedin.com/legal/privacy-policy.
We use the Meta Pixel service on our website. The provider of the service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
The use of the service may result in data being transferred to a third country (USA). The provider is certified under the EU-U.S. Data Privacy Framework and therefore offers an adequate level of data protection.
Further information can be found in the provider's privacy policy at the following URL: https://facebook.com/policy.php.
We use the Microsoft Advertising Web Analytics service on our website. The provider of the service is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland.
The use of the service may result in data being transferred to a third country (USA). The provider is certified under the EU-U.S. Data Privacy Framework and therefore offers an adequate level of data protection.
Further information can be found in the provider's privacy policy at the following URL: https://privacy.microsoft.com/de-de/privacystatement.
We use the Microsoft Clarity service on our website. The provider of the service is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland.
The use of the service may result in data being transferred to a third country (USA). The provider is certified under the EU-U.S. Data Privacy Framework and therefore offers an adequate level of data protection.
Further information can be found in the provider's privacy policy at the following URL: https://privacy.microsoft.com/de-de/privacystatement.
We use the Visual Website Optimizer service on our website. The provider of the service is Wingify, KLJ Tower, 1104, North, Netaji Subhash Place, Pitam Pura, Delhi, India.
The use of the service may result in data being transferred to a third country (India).
Further information can be found in the provider's privacy policy at the following URL: https://wingify.com/privacy-policy.
We use the Hotjar service on our website. The provider of the service is Hotjar Ltd., Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville, St. Julian's STJ 3141, Malta.
Further information can be found in the provider's privacy policy at the following URL: https://www.hotjar.com/legal/policies/privacy/.
We use the Embedly service on our website. The provider of the service is A Medium Corporation, 799 Market Street, 5th Floor, San Francisco, CA 94103, USA.
The use of the service may result in data being transferred to a third country (USA).
Further information can be found in the provider's privacy policy at the following URL: https://embed.ly/legal/terms.
We use the Adjust service on our website. The provider of the service is Adjust GmbH, Saarbrücker Str. 38a, 10405 Berlin, Germany.
The use of the service may result in data being transferred to a third country (USA). The provider is certified under the EU-U.S. Data Privacy Framework and therefore offers an adequate level of data protection.
Further information can be found in the provider's privacy policy at the following URL: https://www.adjust.com/terms/privacy-policy/
If you use simpleclub as an apprentice of a training company or as a pupil of a school or other educational institution, we do not actively use this service, so your behaviour is not tracked.
Our website uses tools that facilitate or enable the placement of advertising and the evaluation of the success of placed ads. For this purpose, personal data is processed, in particular the IP address, access times and device information.
Processing only takes place if you consent to this data processing (via our consent banner on the website). The legal basis for this processing is consent (Art. 6(1)(a) GDPR). Without your consent, the data processing described above does not take place. If you withdraw your consent (e.g. via the consent banner or other options provided on this website), we will stop this data processing. The lawfulness of the processing carried out before the withdrawal remains unaffected.
We use the Google Ads service on our website. The provider of the service is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
The use of the service may result in data being transferred to a third country (USA). The provider is certified under the EU-U.S. Data Privacy Framework and therefore offers an adequate level of data protection.
Further information can be found in the provider's privacy policy at the following URL: https://policies.google.com/privacy.
We use the LinkedIn Ads service on our website. The provider of the service is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.
The use of the service may result in data being transferred to a third country (USA).
Further information can be found in the provider's privacy policy at the following URL: https://www.linkedin.com/legal/privacy-policy.
We use the TikTok service on our website. The provider of the service is TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland.
The use of the service may result in data being transferred to a third country (USA). The provider is certified under the EU-U.S. Data Privacy Framework and therefore offers an adequate level of data protection.
Further information can be found in the provider's privacy policy at the following URL: https://www.tiktok.com/legal/privacy-policy-eea?lang=de.
We use the Snapchat Advertising service from Snap Inc., 63 Market Street, Venice, CA 90291, United States of America, on our website.
The use of the service may result in data being transferred to a third country (USA). The provider is certified under the EU-U.S. Data Privacy Framework and therefore offers an adequate level of data protection.
Further information can be found in the provider's privacy policy at the following URL: https://www.snap.com/en-US/privacy/privacy-policy/
We use tools that protect against unauthorised access, spam and other attacks. This increases the security of our services.
We base this processing on a legitimate interest (Art. 6(1)(f) GDPR).
Our legitimate interest is to be able to ensure the security of our services and to protect ourselves against unauthorised access, spam and other attacks.
We use the Google reCAPTCHA service in our app. The provider of the service is Google Cloud EMEA Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The use of the service may result in data being transferred to a third country (USA). The provider is certified under the EU-U.S. Data Privacy Framework and therefore offers an adequate level of data protection.
Further information can be found in the provider's privacy policy at the following URL: https://cloud.google.com/terms/cloud-privacy-notice?hl=de.
Software frameworks make it easier to interact with a platform by providing a standardised interface to it. Frameworks are used to reduce the development effort for recurring software requirements and to ensure the reusability of code and functions. Some software frameworks implement security features to prevent improper use of the website. Software frameworks can increase functionality, accessibility, security and performance with little effort. Other areas of application can also be covered by software frameworks.
The processing is based on our legitimate interest in ensuring that the website works as well as possible and is displayed to the user as error-free as possible. The legal basis is Art. 6(1)(f) GDPR.
We use the Sentry service in our app. The provider of the service is Functional Software Inc., Virginia Badenhope, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA.
The use of the service may result in data being transferred to a third country (USA). The provider is certified under the EU-U.S. Data Privacy Framework and therefore offers an adequate level of data protection.
Further information can be found in the provider's privacy policy at the following URL: https://sentry.io/privacy/.
We use the PostHog service in our app for the purposes of quality assurance, error handling, product optimisation and LLM traces, as well as for surveys and product tours & in-app engagement. The provider of the service is PostHog Inc., 2261 Market Street 4008, San Francisco, CA 94114, USA.
The use of the service may result in data being transferred to a third country (USA). The provider is certified under the EU-U.S. Data Privacy Framework and therefore offers an adequate level of data protection.
Further information can be found in the provider's privacy policy at the following URL: https://posthog.com/privacy.
We use Typeform. The provider is TYPEFORM S.L., Carrer Bac de Roda, 163, 08018 Barcelona, Spain (hereinafter "Typeform"). Typeform allows us to create online forms and integrate them into our services. The data you enter into our Typeform forms is stored on Typeform's servers until you ask us to erase it or the purpose for storing the data no longer applies (e.g. after your request has been fully handled). Mandatory statutory provisions – in particular retention periods – remain unaffected.
Typeform is used on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in functioning online forms.
For more information on Typeform's data protection compliance, see here: https://admin.typeform.com/to/dwk6gt.
In our app, we use Algolia Search, a search engine service provided by Algolia SAS, 55 Rue d'Amsterdam, 75008 Paris, France ("Algolia"), to search and index content. When Algolia is used, your encrypted IP address is transferred to an Algolia server for the search.
Further information on data protection can be found at:
https://www.algolia.com/policies/privacy/
In our app, we use the search engine service of Elasticsearch B.V., Keizersgracht 281, 1016 ED Amsterdam, Netherlands ("Elasticsearch"), for search and internal user management. When Elasticsearch is used, some of your data is transferred to an Elasticsearch server for search and user management.
Further information on data protection can be found at:
https://www.elastic.co/de/legal/product-privacy-statement
For our messaging infrastructure (email, push notifications and in-app), we use the service provider Braze Inc, 318 W. 39th Street, 5th Floor, New York, NY 10018, USA. We use Braze's services in order to be able to offer our service and thus fulfil our contractual obligations (Art. 6(1)(b) GDPR).
Advertising messages (by email or push notification) are only sent, and their use only evaluated, with your consent pursuant to Art. 6(1)(a) GDPR.
The use of the service may result in data being transferred to a third country (USA). The provider is certified under the EU-U.S. Data Privacy Framework and therefore offers an adequate level of data protection.
For more information on Braze's data protection compliance, see here: https://www.braze.com/privacy.
For our messaging infrastructure (email), we use the service provider Mailjet GmbH, Friedrichstraße 68, 10117 Berlin, Germany. We use Mailjet's services in order to be able to offer our service and thus fulfil our contractual obligations (Art. 6(1)(b) GDPR). Advertising messages by email are only sent, and their use only evaluated, with your consent pursuant to Art. 6(1)(a) GDPR.
If you use simpleclub as an apprentice of a training company or as a pupil of a school or other educational institution, we do not actively use this service, so your behaviour is not tracked.
For more information on Mailjet's data protection compliance, see here: https://www.mailjet.com/de/rechtliches/datenschutzerklaerung/
To provide AI-based features (e.g. our AI Tutor or free-text exercises), we use the services of Microsoft Ireland Operations Limited, South County Business Park, One Microsoft Place, Carmanhall and Leopardstown, Dublin, D18 P521, Ireland. We have taken various measures to ensure that your personal data is not processed by Microsoft. In particular, this includes a filter that checks your input for personal data and is intended to prevent messages containing personal data from being sent to Microsoft. In addition, we have prohibited Microsoft from using any data coming from simpleclub for training purposes. However, these technical measures are not perfect, which is why entering personal data is your own responsibility.
We use Microsoft to provide our service as part of our contractual obligations (Art. 6(1)(b) GDPR). Processing only takes place if you use the AI Tutor or another AI service. The use of the service may result in data being transferred to a third country (USA). The provider is certified under the EU-U.S. Data Privacy Framework and therefore offers an adequate level of data protection.
Further information on data protection can be found at:
https://www.microsoft.com/de-de/privacy/privacystatement
To provide AI-based features (e.g. our AI Tutor), we use the services of Langfuse GmbH, Gethsemanestr. 4, 10437 Berlin, Germany. We have taken various measures to ensure that your personal data is not processed by Langfuse. In particular, this includes a filter that checks your input for personal data and is intended to prevent messages containing personal data from being sent to Langfuse. In addition, we have prohibited Langfuse from using any data coming from simpleclub for training purposes. However, these technical measures are not perfect, which is why entering personal data is your own responsibility.
We use Langfuse for the purposes of troubleshooting, quality assurance and product optimisation (Art. 6(1)(f) GDPR). You can object to this processing via our cookie banner. Processing only takes place if you use the AI Tutor or another AI service. The use of the service may result in data being transferred to a third country (USA). The provider is certified under the EU-U.S. Data Privacy Framework and therefore offers an adequate level of data protection.
Further information on data protection can be found at:
We use Gravatar. The provider is Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA (hereinafter "Gravatar"). Gravatar is a tool that makes it possible to provide personal images (avatars) for the users of our app. The avatars serve as visual representations of the users and are displayed wherever a user interacts with the platform (e.g. in the profile). When a user interacts with the platform, their avatar is displayed based on the selection linked to their email address. This gives users' online presence a personal touch and makes identification easier, as the chosen image is associated with users when they are active online. If you comment or interact on our website while Gravatar is activated, the hash of the email address of the user using Gravatar (which is used as an ID) is processed by Gravatar.
Gravatar is used on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in an appealing presentation of our application.
The use of the service may result in data being transferred to a third country (USA). The provider is certified under the EU-U.S. Data Privacy Framework and therefore offers an adequate level of data protection.
Further details can be found in the provider's privacy policy: https://automattic.com/privacy/.
We integrate payment services from a company specialising in these services on our website and in our app. If you make a purchase from us, your payment data (e.g. name, payment amount, bank details, credit card number) is transmitted to our payment service provider and processed by it for the purpose of payment processing. The contractual and data protection provisions of the provider we have selected apply to these transactions.
The respective contractual and data protection provisions of the respective providers apply to this processing. The payment service providers are used on the basis of Art. 6(1)(b) GDPR (performance of the contract) and in the interest of a payment process that is as smooth, convenient and secure as possible (Art. 6(1)(f) GDPR).
The provider of the Adyen service is Adyen N.V., Simon Carmiggeltstraat 6, 1011 DJ Amsterdam, Netherlands.
Details on the processing by Adyen can be found in Adyen's privacy policy at the following link: https://www.adyen.com/de_DE/privacy-policy.
The provider is RevenueCat.com, 631-633 Taraval St #101, San Francisco, United States.
The transfer of data to the USA is based on the standard contractual clauses of the EU Commission. You can find details here: https://www.revenuecat.com/dpa/.
Details on this can be found in RevenueCat's privacy policy at the following link: https://www.revenuecat.com/privacy/.
This section supplements our Privacy Policy and applies to residents of U.S. states whose privacy laws grant them specific rights regarding their personal data. Depending on your state of residence and subject to applicable exceptions, you may have the right to request access to and information about the personal data we process about you, to obtain a copy of your personal data, to correct inaccurate data, to request deletion of your data, and to opt out of the sale of personal data, the sharing of personal data for cross-context behavioral advertising, targeted advertising, or certain profiling activities. You may also have the right to restrict certain uses or disclosures of sensitive personal data and to appeal our refusal to act on a request. We will not discriminate against you for exercising applicable privacy rights.
We may collect the following categories of personal data: identifiers and contact information; account and subscription information; commercial and payment information; internet, device and application activity; learning progress, test results and interactions with our Platform; approximate location information derived from technical data; communications with us; and inferences or recommendations derived from your use of the Platform. We collect this data directly from you, automatically through your use of our services, from your school, employer or training organisation where applicable, and from service providers or login providers you choose to use. We use the data to provide and secure our services, administer accounts and subscriptions, personalise learning content, provide customer support, process payments, analyse and improve our services and, where permitted, conduct advertising and marketing.
We may disclose personal data to hosting, cloud, analytics, customer-support, authentication, payment, communication and advertising providers for the purposes described in this Privacy Policy. We do not sell personal data. We may, however, share certain identifiers and internet or device activity with advertising partners for cross-context behavioral advertising.
To exercise your rights, please contact us at support@simpleclub.com. Please state your state of residence and the right you wish to exercise. We may take reasonable steps to verify your identity and authority to make the request. You may also use an authorised agent where permitted by applicable law. If we deny your request, residents of states providing an appeal right may appeal by replying to our decision or contacting us at support@simpleclub.com. California residents may exercise their right to opt out by using our Cookie Banner via the “Deny all” and, where applicable, by enabling a legally recognised browser-based opt-out preference signal.
In the context of our business communication with contact persons at companies, schools, educational institutions, suppliers and other business partners, we use internal communication, collaboration and productivity tools, in particular Google Workspace, as well as AI-based assistance systems, in particular Google Gemini and Anthropic Claude.
In the process, personal data of business contact persons may be processed, in particular name, business contact details, company affiliation, content data from emails, notes, appointments and documents, and other information transmitted to us in the context of pre-contractual measures, the performance of a contract or ongoing business communication.
The processing is carried out for the purpose of efficiently handling enquiries, internal communication, drafting and revising business correspondence, structuring and summarising information, and supporting sales, support and administrative processes.
Where the processing is necessary for taking pre-contractual measures or for the performance of a contract, it is carried out on the basis of Art. 6(1)(b) GDPR. Otherwise, the processing is carried out on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in the efficient, secure and economical organisation of our internal business processes and communication. This differentiation according to purpose and legal basis is particularly important for AI-based processing.
We use AI systems exclusively in a supporting role. No decision based solely on automated processing which produces legal effects or similarly significantly affects you takes place in this respect. Input into AI systems is limited to what is necessary. Where possible and reasonable, we avoid or reduce the input of directly personal data through technical and organisational measures such as data minimisation, access restrictions and internal usage guidelines.
In the context of using the services mentioned, personal data may be transferred to recipients in third countries, in particular to the USA. Such a transfer only takes place in compliance with the requirements of Art. 44 et seq. GDPR, in particular on the basis of an adequacy decision or other appropriate safeguards.
You have now worked your way through what is probably the longest legal text at simpleclub and made it! Congratulations!
We hope we were able to show you as clearly as possible what happens to your data at simpleclub. As you have seen, we don't use your data just because we feel like it, but so that you can use simpleclub properly.
If there is anything in this privacy policy that you did not understand, feel free to write to our support team and we will explain everything to you in detail.
But now, have fun with simpleclub and good luck with your next exam!
Best regards,
Your simpleclub team