Privacy Policy

This is an English translation provided for information only. The German version, Datenschutzerklärung, remains the legally binding text.

1. Data protection at a glance

General information

The following information gives you a simple overview of what happens with your personal data when you visit this website. Personal data means all data by which you can be personally identified.

2. Data collection on this website

Who is responsible for data collection on this website?

Data on this website is processed by the website operator. You can find the operator's contact details in the legal notice.

How do we collect your data?

Some of your data is collected because you provide it to us – e.g. by email or via a contact form. Other data is collected automatically by our IT systems when you visit the website. This is mainly technical data (e.g. internet browser, operating system or the time of the page view).

Contact form

If you send us an enquiry via the contact form, we process the data you provide (name, email address, message) solely in order to handle your enquiry. Transmission to our website is encrypted. The form is processed by a server function at our hosting provider (Vercel Inc., see the “Hosting” section), which means the content of your message passes through their systems as well. The enquiry then reaches us by email via our own mailbox with Google Ireland Limited (Google Workspace), where it is stored. No third-party form service is involved. The legal basis is Art. 6(1)(b) GDPR (General Data Protection Regulation) for pre-contractual enquiries, or Art. 6(1)(f) GDPR (legitimate interest in responding); the checkbox in the form confirms that you have read this policy and is not a consent. Please do not include details about individual clients or patients or any health data in the form – call us for such matters. The data is deleted as soon as it is no longer needed to handle the enquiry and no statutory retention obligations apply.

Booking training courses

What we process. When you book a training course via our website, we process the details from the booking form: name, e-mail address and (optional) phone number of the contact person; name and (optional) e-mail address of each registered participant; billing details (name or organisation, department, address, invoice e-mail, cost centre and purchase order number where given); booking details (course, date, seats, price, time of booking, version of the booking terms). We also keep a processing log for each booking (e.g. confirmation sent, substitute entered, cancelled). To protect against automated mass requests we briefly count bookings per internet address and e-mail address; for this we store only a keyed check value, deleted within one day.

Why and on what basis. We process these data to conclude and perform the contract for the training: reserving seats, confirming the registration, sending the access link and materials, running the session, invoicing, allocating payments and communicating changes (Art. 6(1)(b) GDPR). Billing details are additionally retained under statutory obligations (Art. 6(1)(c) GDPR with § 147 AO, § 257 HGB, § 14b UStG). The processing log and the protection against mass requests rest on our legitimate interest in a traceable, undisturbed booking process (Art. 6(1)(f) GDPR).

Details about other people. If you register other people, you give us their names and, where applicable, e-mail addresses. We use these only to enable their participation and to send organisational information for the session. Please inform the people you register; our first message to them will point to this privacy policy.

Newsletter. You can sign up in two ways: by ticking the box in the booking form, or through the form on our newsletter page, which only asks for your e-mail address. The same procedure applies in both cases. If you tick the box asking to be informed about new offers, we first send you an e-mail with a confirmation link. Only when you click that link does the subscription take effect (double opt-in); we store your e-mail address, the wording you agreed to and the times of sign-up and confirmation. We will then write to you about once a quarter about training, consulting and other offers from Innovation Pflegen. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with future effect via the unsubscribe link in every message or by e-mail to the address given in the imprint.

Recipients. For bookings we use these providers: Vercel Inc., Covina, USA – hosts the website and server functions, fixed to the Frankfurt region; processor (Art. 28 GDPR), certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Supabase Pte. Ltd., Singapore – provides the database holding the booking data, running in a data centre in Frankfurt (Amazon Web Services, eu-central-1); processor under the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). Google Ireland Limited, Dublin (Google Workspace) – we send confirmations, changes, cancellations and the newsletter through our mailbox; processor. We do not use a separate newsletter service – messages go out from our own mailbox, and we measure neither who opens a message nor which links are clicked. Olinda SAS (Qonto), Paris, France – our payment institution, through which we issue invoices and receive payments; Qonto receives the billing details and the name of the course, not the participants' names, and processes them as a payment institution under its own responsibility; see Qonto's privacy policy.

Retention. One year after the session ends we redact the participants' names and e-mail addresses and the contact person's phone number. The booking itself with contact person, billing details and invoice reference is kept for eight years from the end of the calendar year of the last event (booking, session or invoice), as required by § 147(3) AO and § 14b UStG, and then deleted completely. The processing log is deleted after one year; only records of deletions are kept as long as the booking. During a tax audit the affected bookings are kept as long as the audit requires. Newsletter consent and its evidence are kept until withdrawal and for three years afterwards to be able to prove the consent. A sign-up that was never confirmed is deleted three years after the last attempt.

Your rights regarding bookings. On request we redact participants' names and e-mail addresses once the session is over. The booking with contact person and billing details is an accounting record which we may not delete before the retention period ends (Art. 17(3)(b) GDPR); in that case we tell you what remains and when it will be deleted. The competent supervisory authority is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

No obligation, no tracking. Bookings are not possible without the mandatory fields; phone number, cost centre, purchase order number and participants' e-mail addresses are optional. The booking form keeps your entries only in your browser's memory until you submit or close the tab. We use no cookies and no analytics in the booking area.

No external services, no tracking cookies

This website does not embed any external fonts, analytics tools or tracking services. All content is delivered directly by our hosting provider. No cookies are set for advertising or analytics purposes.

3. Hosting

We host the content of our website with Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you visit the website, Vercel records technically necessary data (e.g. IP address) in so-called server log files. For details, please see Vercel's privacy policy. Processing takes place on the basis of Art. 6(1)(f) GDPR (legitimate interest in a reliable presentation of the website). We have a data processing agreement with Vercel under Art. 28 GDPR; Vercel acts as our processor, while we remain the controller. We pin server functions – such as the one behind the contact form – to the Frankfurt am Main region; this determines where processing happens, but does not change the fact that the company is based in the USA.

Transfers to the USA

Both our hosting and our contact form may involve processing in the USA. Vercel Inc. is certified under the EU-US Data Privacy Framework. For transfers to certified companies, an adequacy decision of the European Commission under Art. 45 GDPR applies; no additional instrument is required. You have the right to request a copy of the appropriate safeguards – please write to the address given in the legal notice.

4. General information and mandatory disclosures

Data protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection provisions and this privacy policy.

Please note that data transmission over the internet (e.g. when communicating by email) can have security vulnerabilities. Complete protection of data against access by third parties is not possible.

5. Your rights

You have the right at any time to obtain information, free of charge, about the origin, recipients and purpose of your stored personal data. You also have a right to request the correction or deletion of this data. If you have given consent to data processing, you can withdraw that consent at any time with effect for the future. You also have the right to lodge a complaint with a supervisory authority.