Privacy Policy

Responsible for the collection, processing and use of your personal data within the meaning of Art. 4 No. 7 GDPR is:

Sitov Academy

Represented by: Anastasia Sitov

Hüttenstraße 24a

30165 Hannover

Germany

Phone: +49 171 4758620

E-Mail: info@sitov-academy.com

Our website and learning platform run on a virtual server (VPS) at STRATO that we administer. Necessary connection data such as IP address, requested page, time, browser, referrer and error status are processed to deliver and secure the service under Article 6(1)(f) GDPR.

We manage the application, database, authentication and file storage on this server. Technical logs are retained only as long as needed for operation, troubleshooting, security incidents or statutory record-keeping duties. Hosting provider information: https://www.strato.de/datenschutz/

Our hosting provider is STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. The server is located in a data centre in Germany. Our domain and our mailbox (info@sitov-academy.com) are provided by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany; emails you send us are stored there. IONOS privacy information: https://www.ionos.de/terms-gtc/datenschutzerklaerung/

Essential cookies and browser storage support languages, appearance and sign-in. Section 11 explains learning preferences and answers awaiting synchronization. The Meta Pixel for marketing purposes is only loaded with your consent (section 8.6).

Art. 6(1)(b), (f) GDPR; § 25(2) TDDDG. Marketing only with consent: Art. 6(1)(a) GDPR; § 25(1) TDDDG.

Course registrations, waiting lists and participant details are processed in our self-managed database. Authentication and access checks also run on the VPS described in Section 2. Authorized teachers and administrators have access where needed for administration and learning support.

Processed data:

- Name, First Name

- Address (Street, ZIP, City)

- E-Mail Address

- Phone Number

- Course request and language level

- Registration date

Purpose: Management of course registrations, waiting lists, communication with participants, organization of lessons.

Legal basis: Art. 6 Para. 1 lit. b GDPR (contract initiation and execution) and Art. 6 Para. 1 lit. f GDPR (legitimate interest in efficient course management).

Invoices and accounting vouchers are generally retained for eight years from the end of the year of creation (§ 147 AO and, where applicable, § 257 HGB); other records may require six or ten years. Ongoing tax proceedings can extend retention.

We use the service Papierkram.de for the creation and management of invoices.

Papierkram.de: odacer finanzsoftware GmbH, Konrad-Adenauer-Ring 13, 65187 Wiesbaden, Deutschland. https://www.papierkram.de/impressum/

Processed data:

- Name, First Name

- Address

- E-Mail Address

- Invoice information (courses, prices, payment data)

Purpose: Creation and sending of invoices, accounting, fulfillment of tax obligations.

Legal basis: Art. 6 Para. 1 lit. b GDPR (performance of contract) and Art. 6 Para. 1 lit. c GDPR (statutory retention obligations according to HGB/AO).

Invoices and accounting vouchers are generally retained for eight years from the end of the year of creation (§ 147 AO and, where applicable, § 257 HGB); other records may require six or ten years. Ongoing tax proceedings can extend retention.

A data processing agreement pursuant to Art. 28 GDPR exists with Papierkram.de.

Invoices are created manually in Papierkram.de, usually at month-end in advance for the next teaching month. The teacher dashboard stores acceptance status, invoice month, processing status, optional invoice reference and processing time. “Invoice created” confirms neither delivery nor receipt of payment. Receipt of payment is recorded by the separate “Paid” status; it is set by the teacher or from a Papierkram export and releases the certificate of attendance for the booked period.

Registration and course confirmations, cancellation requests, account functions and feedback notifications are sent through the mail server running on our VPS. Delivery jobs are held in a protected queue and retried after temporary delivery failures.

We process the recipient’s email address and, where applicable, name, message content, sending time, technical delivery information and processing status. Data required for delivery are passed to the mail servers of the recipient’s email provider.

The purpose is communication relating to registration, contract performance and learning support. The legal basis is Article 6(1)(b) GDPR and Article 6(1)(f) GDPR for reliable and secure email operation.

Delivery jobs, messages and technical logs are retained according to their communication purpose, troubleshooting needs and statutory retention duties. Data that are no longer needed are deleted. Section 5 applies to invoices and accounting records.

As a data subject, you have the following rights at any time:

- Right of access (Art. 15 GDPR): You have the right to request information about your personal data processed by us.

- Right to rectification (Art. 16 GDPR): You have the right to demand the immediate correction of incorrect or completion of your personal data stored by us.

- Right to erasure (Art. 17 GDPR): You have the right to demand the deletion of your personal data stored by us, unless processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defense of legal claims.

- Right to restriction of processing (Art. 18 GDPR): You have the right to demand the restriction of the processing of your personal data.

- Right to data portability (Art. 20 GDPR): You have the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or to request transmission to another controller.

- Right to object (Art. 21 GDPR): If your personal data are processed on the basis of legitimate interests pursuant to Art. 6 Para. 1 S. 1 lit. f GDPR, you have the right to object to the processing.

- Right to withdraw consent (Art. 7 Para. 3 GDPR): You have the right to withdraw your consent to us at any time. This has the consequence that we may no longer continue the data processing based on this consent for the future.

- Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): You have the right to complain to a data protection supervisory authority about the processing of your personal data by us.

The data protection supervisory authority responsible for us is:

Die Landesbeauftragte für den Datenschutz Niedersachsen

Prinzenstraße 5, 30159 Hannover

Phone: 0511 120-4500

E-Mail: poststelle@lfd.niedersachsen.de

Website: https://lfd.niedersachsen.de

8.1 Hosting and Server Log Files

Section 2 describes hosting and technical logs.

8.2 Cookies

Our website uses cookies. Cookies are small text files that are stored on your device. Without your consent, we use exclusively technically necessary cookies that are required for the basic operation of the website (e.g. to save the language you have selected).

We only use cookies and similar technologies for marketing purposes (Meta Pixel, see 8.6) if you expressly agree via our consent banner. Without consent, the Meta Pixel is not loaded and no connection to Meta servers is established.

Legal basis: The use of these technically necessary cookies takes place on the basis of our legitimate interest in a user-friendly and functional provision of our services (Art. 6 Para. 1 lit. f GDPR).

Storage period: Most of the cookies we use are so-called 'session cookies'. They are automatically deleted after your visit. Other cookies (e.g. for language selection) remain stored on your device until you delete them. You can check your browser settings to be informed about the setting of cookies and only allow cookies in individual cases or exclude the acceptance of cookies for certain cases or generally.

We store your choice from the consent banner in your browser’s local storage (key “sitov-consent”) for a maximum of 12 months; after that we ask again. You can change or withdraw your choice at any time via “Cookie settings” in the footer. Legal basis: § 25(2) no. 2 TDDDG, Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (proof of consent).

8.3 Registration for Courses

If you register for a course via our website, by e-mail or by paper form on site, we collect the data necessary for the execution of the contract:

- Name and First Name

- Contact details (E-Mail, Phone)

- Address details

- Booked course data

- Further voluntary information that you have provided to us

For offline registrations: The data from the signed paper form are manually entered by us into our course management system (on our self-managed VPS). The original form is kept by us in accordance with the statutory retention periods. For offline registration, we additionally collect your handwritten signature on the registration form.

Legal basis: The processing of this data takes place for the implementation of pre-contractual measures and for the fulfillment of a contract (Art. 6 Para. 1 lit. b GDPR).

Invoices and accounting vouchers are generally retained for eight years from the end of the year of creation (§ 147 AO and, where applicable, § 257 HGB); other records may require six or ten years. Ongoing tax proceedings can extend retention.

8.4 Course Support and Homework (Telegram)

For communication with the teacher, the exchange of homework and daily course support, we use the messenger service Telegram. Participation in the Telegram channel/group is optional, but recommended for optimal course support.

Provider: Telegram Messenger LLP, Dubai, United Arab Emirates / Telegram FZ-LLC, Dubai

Server locations: Distributed worldwide (exact locations are not public)

Processed data:

- Telegram username and user ID

- Profile picture (if available)

- Phone number (depending on your Telegram settings)

- Messages, homework, shared files and media

- Metadata (timestamp, IP address on connection)

Purpose: Fast communication between teacher and participants, exchange of homework, provision of learning materials, organization of the course flow, answering questions.

Legal basis: The use of Telegram takes place on the basis of your express consent according to Art. 6 Para. 1 lit. a GDPR. By joining the Telegram group, you consent to data processing by Telegram. You can withdraw your consent at any time by leaving the Telegram group or informing us by e-mail.

Notes on data protection risks:

- No standard end-to-end encryption: Normal chats and group chats are not end-to-end encrypted. Only 'Secret Chats' offer this function.

- Server locations: Telegram stores data on servers distributed worldwide. The exact locations are not transparent.

- Third country transfer: Data transfer takes place to countries outside the EU that do not offer an equivalent level of data protection.

- Metadata: Telegram stores metadata (who communicates with whom) for up to 12 months.

- Access by authorities: Depending on the server location, local authorities may demand access to data under certain circumstances.

- Alternative communication: If you have concerns regarding Telegram, you can alternatively communicate with us by e-mail. We strive to ensure good course support even without Telegram.

Storage period: Messages in Telegram groups are stored for the duration of the course and up to 6 months after the end of the course, unless the group is deleted earlier. You can delete your own messages yourself at any time.

Further information on data protection at Telegram: https://telegram.org/privacy

8.5 Contact (E-Mail, Phone)

If you contact us by e-mail or phone, the data you provide (your e-mail address, possibly your name and phone number) will be stored by us to answer your questions.

Legal basis: Art. 6 Para. 1 lit. b GDPR (for contract initiation) or Art. 6 Para. 1 lit. f GDPR (legitimate interest in efficient communication).

8.6 Meta Pixel (only with consent)

Only with your express consent do we use the Meta Pixel on our website. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (parent company: Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA).

Purpose: measuring the effectiveness of our ads on Facebook and Instagram (e.g. whether a click on an ad leads to a trial lesson request or a course registration) and delivering these ads, for example to people who have already visited our website.

Processed data: IP address and browser information transmitted technically, time, only the public home or course registration page without URL parameters or fragments, and explicit events (page view, trial lesson request or course registration with public course IDs and amount). Referring pages and form field data are not transmitted. A valid Facebook click identifier from an advertising link is retained in memory for the current registration journey only after consent; existing valid Meta identifiers “_fbc” and “_fbp” may be transmitted. We do not set new identifier cookies for this. Meta may associate requests with a Facebook or Instagram account using its own cookies. Learning, administration, sign-in and password pages are excluded.

Legal basis: your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw your consent at any time with effect for the future via “Cookie settings” in the footer; the lawfulness of processing carried out before the withdrawal remains unaffected.

Joint controllership: we and Meta Platforms Ireland Limited are jointly responsible for collecting the data on our website and transmitting it to Meta (Art. 26 GDPR). The details are set out in the joint controller agreement: https://www.facebook.com/legal/controller_addendum. Meta is solely responsible for any subsequent processing.

Transfer to third countries: Meta may transfer data to the USA. Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR) and additionally on standard contractual clauses (Art. 46(2)(c) GDPR). Please note the general risks of a transfer to third countries (theoretical access by US authorities).

Further information: https://www.facebook.com/privacy/policy/

We use Microsoft Teams for online teaching. Regular online group courses and online trial lessons are always recorded for later viewing by participants of the same course. Online private lessons are exempt from this recording rule.

Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (parent company: Microsoft Corporation, USA).

9.1 Type and Purpose of Processing

When using Microsoft Teams, various types of data are processed. The scope of data also depends on the information you provide before or during participation in an online session.

Processed data: Meeting metadata (e.g. date, time, meeting ID), audio and video data (your voice and image), text inputs (chat function) as well as video recordings of the teaching sessions.

Purpose of recording: The recordings serve exclusively the participants of the respective course for review and revision of the learning content.

9.2 Legal Basis

The use of Microsoft Teams for the general delivery of instruction is based on Art. 6 Para. 1 lit. b GDPR (performance of contract).

For recording your voice and image, we obtain separate explicit consent at registration under Article 6(1)(a) GDPR. Registration for regular online group courses and online trial lessons requires this consent. The checkbox starts unchecked and must be confirmed individually; confirming the other required points does not select it. Online private lessons are exempt.

9.3 Storage Duration and Access

The video recordings are stored in a protected environment (e.g. password-protected cloud storage from Microsoft). Access is strictly limited to the instructor and the registered participants of the same course. No disclosure to third parties takes place.

The recordings are permanently deleted no later than 30 days after the completion of the respective course.

9.4 Withdrawal of Consent

You may withdraw your recording consent at any time for the future by contacting info@sitov-academy.com or your teacher. Tell your teacher before the online session if consent is absent or withdrawn. Before recording, the teacher must check that only people with valid consent are captured; otherwise that recording must not take place.

9.5 Data Transfer to Third Countries (USA)

When using Microsoft Teams, data processing in the USA may occur. The transfer is based on the EU-US Data Privacy Framework (DPF) as well as supplementary Standard Contractual Clauses (SCCs). Microsoft is DPF-certified. Please note the general risks of third-country transfers (theoretical access possibilities by US authorities).

Further information: https://privacy.microsoft.com/de-de/privacystatement

We use the widespread SSL procedure (Secure Socket Layer) in connection with the highest encryption level supported by your browser during the website visit. You can recognize whether a single page of our internet presence is transmitted in encrypted form by the closed representation of the key or lock symbol in the address bar of your browser.

The platform processes account details (email, profile name, language), released levels and booked courses, vocabulary phases, review directions and dates, answers, exercise attempts and results. This supports individual practice, progress display and teacher support under Article 6(1)(b) GDPR. Access protection and security logging are based on Article 6(1)(f) GDPR.

An existing student record is linked only after verified sign-in and an unambiguous match. Entering a known email address alone does not reveal stored student information. Ambiguous matches require review by the school. Authorized teachers and administrators access information needed for teaching and course administration.

Browser storage and essential sign-in cookies retain language, theme, session state, selected learning sets and, where necessary, answers awaiting synchronization. Local preferences remain until deleted in the browser. Personal learning records are stored for use and support of the account and deleted when it ends, unless separate statutory duties or a specific need to preserve legal claims require retention. Requests for access or deletion can be sent to info@sitov-academy.com.

Your teacher and authorised administrators can see your learning progress, vocabulary boxes and due reviews, answers to shared course vocabulary and learning path exercises, test attempts and results, unlocked levels, pronunciation conversations and teaching notes. This helps them identify difficulties, offer targeted support and unlock or reset a learning path or test when needed. The content of your own words and answers to them stays private; only their number is shown.

For the activity overview, we record only learning sessions based on saved answers and submitted recordings: start and end, learning mode, level and number of answers. We do not record click trails or individual keystrokes for this purpose. Displayed study time is an estimate between successive learning answers; gaps longer than five minutes, time before the first or after the last answer, and simply viewing media are excluded. We do not reconstruct study time for earlier learning days.

Raw learning session records are automatically deleted after 180 days the next time any learning activity is saved on the platform, including records for accounts that have become inactive. The activity log then retains only daily totals (learning day, last activity that day, number of answers and estimated time per mode) for the lifetime of the learning account. This period applies to the additional session log; learning answers, results, recordings and teaching notes follow the account and pronunciation support rules in sections 11 and 12.

You choose a reading text and start microphone recording yourself. Before submission, the recording stays in your browser. Submitting stores your voice, selected text, level, timestamps and subsequent text or voice messages for personal feedback under Article 6(1)(b) GDPR. You can revoke browser microphone permission at any time.

Trainer recordings are stored in access-controlled file storage on our VPS. The relevant student and authorized teachers and administrators have access. Conversations allow repeated replies and use timestamps and read status. Recordings are not automatically published or uploaded to YouTube. We do not use voice recordings for biometric identification or automated voice assessment. Recordings and messages remain for support of the learning account; the retention and deletion criteria in the preceding section apply.

Text-to-speech processes learning words and reference texts directly on our VPS. Locally installed speech software generates audio, which is cached for faster repeat playback. Texts and student recordings are not sent to an external speech service for this purpose. Student recordings are not automatically analyzed. Please do not include confidential personal details in learning texts.

Learning videos and presentations that we upload ourselves are stored on our server (VPS) in Germany; no data is transferred to third parties when you access them. YouTube players or preview images are never loaded automatically. Only when you open a marked external link (e.g. to YouTube) do you leave our platform; the privacy policy of that provider then applies (for YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; https://policies.google.com/privacy).

This Privacy Policy reflects the learning platform’s features and operation on a self-managed VPS as of 26 September 2026. We update this information when processing changes.