Privacy policy

Lernnest Heepen GbR, Salzufler Straße 41, 33719 Bielefeld, Germany. Telephone +49 521 3298140, email hallo@lernnest-heepen.de. We have not appointed a data protection officer because we are not required to; enquiries about data protection go to the address above and are answered by Nadine Ostermann.

When you open a page, your browser transmits technical data to our hosting provider, which stores it in server log files: IP address, date and time, the page requested, the referring page, browser and operating system. This is processed on the basis of Art. 6(1)(f) GDPR in order to operate the site securely, and the log files are deleted after seven days. Our hosting provider is Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, acting as our processor under Art. 28 GDPR on the basis of standard contractual clauses.

We use no analytics, no tracking pixels and no advertising cookies. If you choose a class year with the age-band picker, that choice is stored in the local storage of your own browser so the site is still arranged for that child on the next page. It is never transmitted to us and you can delete it at any time by clearing your browser data or by pressing "Show everything again" in the picker. The cookie banner stores your answer to it in the same way.

The map on the contact section is not loaded until you press the button on it. Only then is a connection made to OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom, which receives your IP address. The legal basis is your consent under Art. 6(1)(a) GDPR, which you may withdraw at any time by reloading the page.

If you send us an enquiry we process the name and contact details you enter, the first name and class year of your child, and anything you write in the message field. The legal basis is Art. 6(1)(b) GDPR — steps taken at your request prior to entering into a contract. Where the enquiry contains details about a child, the additional basis is Art. 8 GDPR: the enquiry is made by the holder of parental responsibility, who is asked to confirm this before sending. We do not accept enquiries submitted by children themselves.

We deliberately ask for as little as possible: a first name is sufficient for the child and we do not ask for a surname, a date of birth, an address, a school report or a photograph. If no place is taken up, enquiry data is deleted no later than six months after our last contact with you. If a place is taken up, the data becomes part of the contract file described in section 6.

For a child who has a place we keep: the child's first and last name, class year and school, the name and contact details of the parent or guardian, the group and times booked, attendance dates, and one line per session describing what the group worked on. We keep no marks, no assessments of ability, no behaviour notes and no photographs. The legal basis is Art. 6(1)(b) GDPR for performing the tuition contract, together with Art. 8 GDPR for the parts relating to a child under 16, for which consent is given by the holder of parental responsibility.

Attendance and session notes are deleted twelve months after the place ends. Contract and invoice data is kept for ten years because §§ 147 AO and 257 HGB require it, and is used for nothing else during that time.

Parents with a place receive a login to a page showing attendance dates, the session notes described above, upcoming dates, the current invoice and a message thread with the tutor. The same login shows the same page to the child; there is no separate parent-only content. The page contains no location data, no camera, no device or screen monitoring and no scoring of any kind. Access ends and the login is deleted when the place ends.

Quotations from learners are published with a first name and class year only, and only where the holder of parental responsibility has given written consent and the child has agreed. Consent can be withdrawn at any time with effect for the future and we remove the quotation at the next site update, normally within a few days.

Your data is not sold and is not passed on for advertising. It is seen by our tutors and administrators to the extent they need it, by our hosting provider as processor, by our tax adviser and, for invoicing, by our bank. No transfer to a third country takes place beyond the hosting arrangement described in section 2.

You have the right to information (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Where processing is based on consent you may withdraw it at any time with effect for the future. These rights also apply to the data of your child and are exercised by you on their behalf. Write to hallo@lernnest-heepen.de and we will answer within one month.

You may complain to a supervisory authority. The one responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf.

We update this policy when the site or our processing changes. This version is dated 1 September 2026.