Privacy Policy
1. Who is responsible
The controller is TwentySix L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates. Email: support@passgerman.com.
2. What this policy covers
This policy covers the website passgerman.com and the PassGerman app at app.passgerman.com.
3. Visiting the website
When you open a page, your browser sends technical data to our hosting provider: your IP address, the date and time, the page requested, the referring page, and your browser and operating system. This data is needed to deliver the website securely and to detect errors and abuse. The legal basis is our legitimate interest in a secure, working website (Art. 6 (1) (f) GDPR). Log data is deleted by the hosting provider after a short period.
4. Hosting
The website and the app are hosted by Vercel Inc., USA. Vercel processes the data described in section 3 on our behalf. Data may be processed in the USA. Such transfers are based on appropriate safeguards under Art. 44 et seq. GDPR, such as the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses. More: Vercel privacy policy.
5. Website statistics without cookies (Vercel Web Analytics)
We use Vercel Web Analytics from Vercel Inc., USA, to count page views and see which pages are used, for example the page visited, the referring page, the country, and the device and browser type. Vercel Web Analytics doesn't set cookies and doesn't store anything on your device. Visitors aren't identified: according to Vercel, the data is aggregated and the anonymous identifier used to count visits is discarded after 24 hours. The legal basis is our legitimate interest in understanding and improving our website (Art. 6 (1) (f) GDPR). You can object at any time (Art. 21 GDPR). More: Vercel Web Analytics privacy.
6. Cookies and your consent
passgerman.com only sets analytics cookies if you agree in our cookie banner. Vercel Web Analytics (section 5) works without cookies.
We only use cookies and similar technologies for analytics and marketing if you agree in our cookie banner. The legal basis is your consent (Art. 6 (1) (a) GDPR and § 25 (1) TDDDG). Without your consent, these tools are not loaded.
We store your choice in your browser (local storage) so the banner does not appear on every page. This is strictly necessary to respect your choice (§ 25 (2) TDDDG, Art. 6 (1) (c) and (f) GDPR).
You can change or withdraw your consent at any time with the "Cookie settings" link in the footer. Withdrawal does not affect the lawfulness of processing before it.
7. Analytics and advertising tools
Google Tag Manager and Google Analytics 4 are active and only load with your consent. Google Ads and the Meta Pixel are not active yet. If we switch them on, they are also only used with your consent. Some of them process data in the USA. Such transfers are based on the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses.
Google Tag Manager
Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, loads the tools below once you consent. Tag Manager itself does not create user profiles, but it processes your IP address to deliver the tools. We use Google Consent Mode, so Google tools respect your choice.
Google Analytics 4
With your consent for analytics, Google Analytics 4 (Google Ireland Limited) measures how visitors use our website, for example which pages are viewed, how long visits last and which device and approximate location are used. IP addresses are not stored by Google Analytics 4. We use this data to improve the website. More: Google privacy policy.
Google Ads conversion tracking and remarketing
With your consent for marketing, Google Ads (Google Ireland Limited) measures whether a visit that started with one of our ads leads to an action on our website, for example starting a free mock exam or signing up. With remarketing, Google can show our ads to you on other websites after you visited our site.
Meta Pixel
With your consent for marketing, the Meta Pixel from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, measures the success of our ads on Facebook and Instagram and lets us show ads to people who visited our website. Meta may link this data to your Facebook or Instagram account. For the collection and transfer of data to Meta, we and Meta are joint controllers (Art. 26 GDPR). More: Meta privacy policy.
8. Your PassGerman account
When you create an account in the PassGerman app, we process your email address, the profile details you enter, your exam answers, scores and progress. We need this data to provide the service you signed up for (Art. 6 (1) (b) GDPR). Accounts and exam data are stored with Supabase, Inc., which processes the data on our behalf. Data may be processed outside the EU, based on the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework. We delete your account data when you delete your account, unless legal retention periods apply. More: Supabase privacy policy.
Writing corrections and translation
When you use the corrections on your exam email or the translation in practice mode, the text you wrote or selected is sent to Google's Gemini API (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to create the feedback or translation. Please don't enter personal details in your exam answers. We use this to provide the feature you asked for (Art. 6 (1) (b) GDPR). Data may be processed in the USA, based on the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses. More: Google privacy policy.
9. Payments
Premium is sold by our reseller Paddle.com Market Limited, Judd House, 18-29 Mora Street, London EC1V 8BT, United Kingdom, which is the Merchant of Record for all our orders. When you buy, you enter your payment details, name, email address and country directly in the Paddle checkout. Paddle processes this data as an independent controller to take your payment, calculate tax, issue your invoice and handle refunds. We do not receive your full payment details. Paddle tells us your email address, country and what you bought, so we can unlock Premium in your account. The legal basis is the performance of your contract (Art. 6 (1) (b) GDPR) and our legal obligations to keep accounting records (Art. 6 (1) (c) GDPR). More: Paddle privacy policy.
10. Links to other websites
Our pages link to other websites, for example exam centers, telc.net, Preply and Wikimedia Commons. These sites only receive your data if you click a link. Their own privacy policies apply there.
11. Contacting us
If you email us, we use your email address and message only to answer your request. The legal basis is Art. 6 (1) (b) or (f) GDPR. We delete the correspondence when it is no longer needed, unless legal retention periods apply.
12. Your rights
You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16) or deleted (Art. 17), to restrict processing (Art. 18), to data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time (Art. 7 (3)). To use these rights, email us. You also have the right to lodge a complaint with a data protection supervisory authority, for example in the EU country where you live.