Privacy policy

The controller for the processing of personal data on GermanProMax (germanpromax.com) is: DIAA BUSINESS GROUP — FZCO, Dubai Silicon Oasis, Dubai, United Arab Emirates Email: contact@germanpromax.com, phone: +971 50 109 9894 Full address and representation: see the imprint.

We have no establishment in the European Union and therefore designate a representative in the EU under Art. 27 GDPR. Name and address of the representative: To be designated. Until then, you can reach us on all data protection matters at contact@germanpromax.com.

We process personal data only as far as necessary for the following purposes: – Account and sign-in: email address, password (stored only as a hash), an optional display name, interface language, time zone, email confirmation, and sessions with a rough device label. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). – Learning: learning progress, answers, test and exam results, flashcards, daily plans and errors in content that you report. Legal basis: Art. 6(1)(b) GDPR. – AI grading of open tasks: your texts and voice recordings. We convert voice recordings to text on our own server. We pass only the task, the grading rubric and your text or transcript to the AI service, without email address, name or account identifier. Legal basis: Art. 6(1)(b) GDPR. – Purchase and payment: product purchased, price, currency, tax amount, issuing country of the payment card, payment and subscription status, and the time and version of your consent to the immediate start of performance. Only Stripe receives card details, not us. Legal basis: Art. 6(1)(b) and (c) GDPR (commercial and tax obligations). – Emails: confirmation and security emails (Art. 6(1)(b) GDPR) and notes on the service you booked, which you can unsubscribe from at any time (Art. 6(1)(f) GDPR; our legitimate interest is supporting your learning). – Placement test without an account: your answers and the result, linked to a random identifier in a cookie. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures). – Origin of the registration: campaign details from the address you opened (UTM parameters), stored on the server, without a tracking cookie. Legal basis: Art. 6(1)(f) GDPR (measuring our advertising). – Security and operation: server logs, abuse protection with IP addresses stored only as a hash, and a log of access by our administration. Legal basis: Art. 6(1)(f) GDPR (secure operation). We do not use advertising or analytics services. There is no automated decision within the meaning of Art. 22 GDPR: AI grading is a learning aid, and a human decides on any objection.

– Stripe (Stripe, Inc. and affiliated companies): payment processing, subscriptions, invoices and receipts, customer portal. You enter your payment details directly on Stripe’s payment page, where Stripe’s privacy policy also applies. – OpenRouter (OpenRouter, Inc., USA) and the language model provider arranged by OpenRouter: grading of open tasks. We only allow providers that neither store the data nor use it for training. – Hetzner Online GmbH (Germany): operation of our server in a data centre in Germany, including database, email delivery and speech recognition. Within our company, only administration accounts see your submissions, and only for spot checks and objections; every such access is logged. Beyond that, we share data only where the law requires us to.

Our company is based in the United Arab Emirates. There is no adequacy decision of the European Commission for the UAE. Your data is stored on our server in Germany; we access it from the UAE to perform the contract with you. Stripe and OpenRouter also process data in the USA, and the model provider arranged by OpenRouter may do so in another third country. The basis is the adequacy decision on the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR). Conclusion and evidence of these safeguards: [missing] You can request a copy of the safeguards at contact@germanpromax.com.

– Account: until deletion. After deletion we block the account immediately and anonymise it after 30 days, deleting learning progress, submission texts, transcripts and recordings. – Voice recordings: 90 days after grading; the transcript and grade remain until the account is deleted. – Purchase data: anonymised, for up to ten years where commercial and tax retention obligations require it. – Sessions: at most 90 days, earlier after 14 days without use; ended sessions and used links from emails for a further 30 days. – Placement test without an account: 30 days unless you transfer the result to an account. – Counters for abuse protection: 24 hours. – Backups: 30 days. – Web server logs: [missing]

We only set cookies that are technically necessary for the service (section 25(2) no. 2 of the German TDDDG). We therefore do not ask for consent. – __Host-gpm_session: keeps you signed in. Valid for at most 90 days, earlier after 14 days without use; deleted when you sign out. – __Host-gpm_placement: links a placement test without an account to your browser. Valid for 30 days. Neither cookie can be read by scripts, and both are only transmitted encrypted. We do not use cookies for tracking, advertising or analytics. Stripe’s cookie rules apply on Stripe’s payment page and customer portal.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on our legitimate interest (Art. 21). You can withdraw any consent at any time with effect for the future (Art. 7(3)). In your account you download your data yourself as a file (JSON) and delete your account. You unsubscribe from notes on your booked service via the link in each of these emails. For anything else, write to contact@germanpromax.com.

You can lodge a complaint with any data protection supervisory authority in the EU, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR). For users in the United Arab Emirates, Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) also applies; complaints there are handled by the UAE Data Office.

Send questions about data protection and requests concerning your rights to contact@germanpromax.com. We reply within one month (Art. 12(3) GDPR). Version: 25.10.2026