Privacy notice

1. Controller

The controller responsible for processing your personal data on deutschniveau.com is:

International Test Limited, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom, email: hallo@deutschniveau.com

Please send privacy requests to: hallo@deutschniveau.com

2. Data we process

• First and last name (shown on the certificate)
• Email address
• Name of your institution, if you provide it
• Your answers in the test, the result per level and skill, start and end time of the test
• Certificate number and date of issue
• Technical data when you visit the website (e.g. IP address, time, browser) in our hosting provider’s server logs
• When certificates are verified: a non-reversible hash of your IP address and the number of requests (protection against mass guessing of certificate numbers)

3. Purposes and legal bases

• Running and scoring the placement test and issuing the certificate – Art. 6(1)(b) GDPR (providing the service you requested)
• Online verification of a certificate by third parties using the certificate number – Art. 6(1)(b) and (f) GDPR (legitimate interest in forgery-proof certificates)
• Contacting you about your result by email – Art. 6(1)(b) GDPR
• Operating, securing and debugging the website – Art. 6(1)(f) GDPR
• Limiting certificate verification requests so that names cannot be collected by guessing numbers – Art. 6(1)(f) GDPR

4. Public certificate verification

Anyone who knows the certificate number (e.g. via the QR code on the certificate) can see your name, the level reached and the date of issue at deutschniveau.com/pruefen. No other details, such as your email address, scores or answers, are shown there.

Certificate numbers consist of eight random characters and are practically impossible to guess. In addition, the number of requests per user is limited.

5. Recipients and processors

• Hosting: Vercel Inc., USA – server location Frankfurt am Main (EU) for server functions; static content via a global delivery network
• Database: Supabase Inc., USA – server location Frankfurt am Main (EU)

Data processing agreements under Art. 28 GDPR are in place or will be concluded with both providers.

Fonts are served from our own server; no data is sent to Google Fonts when you visit the website.

6. Retention

• Unfinished tests: until deletion; they contain neither a name nor an email address
• Completed tests, results and certificates: for as long as the certificate can be verified online, and beyond that only where statutory retention obligations apply
• Hosting provider server logs: according to the provider’s policy
• Certificate verification request counters (hash of the IP address): at most 1 day

On request we delete your data earlier unless statutory retention obligations apply. After deletion the certificate can no longer be verified online.

7. Storage in your browser

• Cookies “lang” (language) and “theme” (light/dark design): only store your display settings, valid for 1 year
• Local storage: the ID of your test session and answers not yet sent, so you can continue after reloading
• Cookie “dn_consent”: stores your choice about Google Analytics and advertising measurement (section 12), duration 1 year

No cookies for personalised advertising are used. Cookies of Google Analytics and for measuring advertising success (Google Ads) are only set with your consent (section 12). The other storage is necessary for the function you requested.

8. Audience measurement (Vercel Web Analytics)

To understand which pages are used and where visitors come from, we use Vercel Web Analytics (Vercel Inc., USA). No cookies are set and nothing is stored in your browser.

• Collected: the page visited (without certificate numbers and without query parameters, except the “src” tag of a guide link), referring website, device type, browser, operating system and country.
• If a visit comes from an AI service (e.g. ChatGPT, Perplexity, Copilot, Gemini), only the name of that service is additionally counted as a channel.
• Data is evaluated only in aggregate; individuals are not identified.

The legal basis is our legitimate interest in privacy-friendly audience measurement (Art. 6(1)(f) GDPR). As nothing is stored on or read from your device, no consent under § 25 TDDDG is required.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21).

You can also lodge a complaint with a data protection supervisory authority, for example in your place of residence.

People in Turkey additionally have the rights under Art. 11 of Law No. 6698 (KVKK); see the Turkish version of this notice.

10. Obligation to provide data

Your name and email address are required to take the test and receive a certificate. Without them you cannot take part. Providing an institution is optional.

11. Contact form and email enquiries

If you write to us using the contact form (deutschniveau.com/en/contact) or by email, we process:

• your name, email address, the subject you chose, your message and – if provided – the certificate number
• the time of the message, the language of the page and an irreversible hash of your IP address (limit of 5 messages per hour, spam protection)

The purpose is to handle and answer your enquiry. The legal basis is Art. 6(1)(b) GDPR if your enquiry concerns a contract or steps prior to one (e.g. a certificate or a payment), otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries and preventing abuse).

Messages are stored in our database (Supabase, see section 5). If forwarding by email is enabled, the message is also sent to our mailbox via the email service Resend.

Retention: once your enquiry has been dealt with, we keep the message for 12 months (for follow-up questions on the same matter) and then delete it. On request we delete it earlier, unless statutory retention obligations apply.

Your name, email address and message are required so that we can reply. We do not use a captcha or tracking for this.

12. Google Analytics and advertising measurement (only with your consent)

If you choose “Accept” in the cookie notice, we use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to understand how our pages are used. Without your consent, Google Analytics is not loaded.

• Collected: pages viewed (without certificate numbers and without query parameters except “src”), page titles without certificate numbers, referring website, device, browser, approximate location (country/region) and interactions on the page.
• Google stores cookies for this (“_ga”, “_ga_<ID>”) in your browser for up to 2 years. Google Signals and ad personalisation are disabled. Google Analytics 4 does not store IP addresses.
• Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework.

Measuring advertising success (Google Ads conversions): with the same consent we learn whether a purchase came from one of our Google ads. For this, the purchase event from Google Analytics (order number, amount, currency, package; no name, no email address) is passed to our Google Ads account (Google Ireland Limited), and Google may set cookies such as “_gcl_au” or “_gcl_aw” (up to 90 days) that link an ad click to a later purchase. We use Google Consent Mode: without consent, no Google script is loaded and nothing is measured. We do not use personalised advertising or remarketing.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time via “Cookie settings” at the bottom of every page; the Google Analytics cookies are then deleted. Withdrawal does not affect the lawfulness of processing before it.

13. Customer account

You can sign in with the email address you entered for the test. There is no password: you receive a sign-in link by email that is valid for 1 hour. We use Supabase Auth (Supabase Inc., see section 5) for sign-in; your email address, times of sign-in and confirmation and technical session data are stored.

Your account shows all tests, results, certificates and payments linked to the same email address. They are matched exclusively by the confirmed email address. Optionally we store your name for future certificates and your language.

• Cookies “sb-…-auth-token”: keep you signed in (technically necessary, § 25(2) no. 2 TDDDG); they are deleted when you sign out.

The legal basis is Art. 6(1)(b) GDPR (providing the account you use).

Deleting your account: under “Account” you can delete your account at any time. Your account, account settings and tests without a certificate and without a payment are then deleted. For certificates already issued and payments, the certificate number, level, date and payment data are kept – so the certificate can still be verified (Art. 6(1)(f) GDPR) and because of statutory retention obligations (Art. 6(1)(c) GDPR); your name is shortened to initials there and your email address is removed. The verification page then only shows the initials.

14. Internal administration

For support, refunds, revoking certificates and preventing misuse we use an internal administration interface. Only the operator has access, through a personal account confirmed by email; it shows tests, results, certificates, payments and contact requests. Email addresses are shortened in lists.

Every change (for example a refund, revocation or deletion) is logged with time, acting person and affected record. The legal basis is Art. 6(1)(b) GDPR (performance of the contract, refunds) and Art. 6(1)(f) GDPR (legitimate interest in support and preventing misuse).

15. Reminder emails after the test

If you have finished the test, confirmed your name and not yet paid, we send at most two emails to the address you gave:

• Email 1 („Your certificate is ready“) shortly after the test: it contains the link to your evaluation and the packages, but no result. The legal basis is Art. 6(1)(b) GDPR (providing the evaluation you requested).
• Email 2 („Your result“) about two hours after the test, only if you expressly agreed on the page after the test (checkbox, not pre-ticked). It states a range of correct answers in percent, not your level. The legal basis is your consent (Art. 6(1)(a) GDPR, § 7(2) UWG); we store the time and text version of your consent.

Once you pay, we send no further reminders. Within 30 days we send at most one reminder series to the same address, and only for the most recently finished test.

Unsubscribing: every email contains the link „No more reminders“. One click is enough; you do not need to sign in. After that we send no more reminders to this address; for this we store only a hash of the email address, not the address itself. Emails about an order (e.g. the order confirmation) are not affected. You can withdraw your consent at any time with effect for the future, also by email to hallo@deutschniveau.com.

The emails are sent via Resend (see section 5). Whether you clicked a link in the email is counted only on our server from the link itself; we do not use tracking pixels or open tracking.