Privacy policy

This policy explains what personal data we process when you visit our website, write to us, register for a course or a waitlist, sign up for course dates by email or take part in online lessons, and what rights you have under the EU General Data Protection Regulation (GDPR). Where it differs from the German version, the German version applies.

Controller

Global Aspire Network e.V. (Ja Wohl!)
Elsa-Brändström-Straße 10, 69126 Heidelberg, Germany
represented by its board: Mithun A. Sridharan, Melissa E. Dietrich
Email: hello@jawohl.org

Hosting and server logs

The website runs on Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). When you open a page, Cloudflare processes technical data that your browser sends: your IP address, the date and time, the page requested, the referring page, and your browser and operating system. This is needed to deliver the website securely and to protect it against attacks (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU–US Data Privacy Framework, and we have a data processing agreement with it.

Fonts are served from our own domain. Opening the website does not send your data to font providers.

Email

Our mailboxes, and every email we send, run on Purelymail (Add Rabbit LLC, USA), whose servers run on Amazon Web Services. Purelymail processes the addresses, content and technical data of these emails only to provide the service (Art. 6(1)(b) and (f) GDPR), does not sell data, encrypts stored data and deletes diagnostic logs after 30 days.

Contact form

When you write to us through the contact form, we process your name, email address, the topic you chose, the subject and your message to answer your enquiry (Art. 6(1)(b) GDPR where it concerns a course, otherwise Art. 6(1)(f) GDPR). The message is held in our database (Cloudflare D1) until you confirm your address from the link we email you (at most 48 hours), and is then delivered to us by email. We delete enquiries once they are resolved, unless we must keep them for legal reasons.

Course registration and contract

When you register for a course, we process your first and last name, email address, phone number (if given), postal address, and, if the invoice goes to your employer, its name, address and VAT ID (if given); the course you chose; your optional note on your learning goal; your declarations on the terms, the cancellation policy and privacy; and the time of registration. We need this data to conclude and perform the contract, to invoice you and to invite you to the lessons (Art. 6(1)(b) GDPR).

Your registration is delivered to us and to you by email, and also stored in Cloudflare Workers KV so that the website can count the free places in a course. It is deleted there automatically 30 days after the last lesson. For a waitlist entry we process the same data to offer you a place that becomes free (Art. 6(1)(b) GDPR); the entry is also deleted 30 days after the course ends.

We keep invoices, payment records and the related correspondence for as long as tax and commercial law requires, usually six to ten years (§ 147 AO, § 257 HGB), and use them for nothing else (Art. 6(1)(c) GDPR).

Payment

You pay the course fee by bank transfer. Your bank and ours process the details of the transfer (name, account, amount, reference). We match the payment to your registration (Art. 6(1)(b) and (c) GDPR).

Online lessons

Lessons take place live in a virtual classroom on Zoom (Zoom Communications, Inc., 55 Almaden Blvd, San Jose, CA 95113, USA). This involves your display name, your email address (for the invitation), your picture and voice while your camera and microphone are on, chat messages and technical connection data. This is necessary to teach the course (Art. 6(1)(b) GDPR). We do not record lessons. Zoom is certified under the EU–US Data Privacy Framework, and we have a data processing agreement with it.

Course dates by email

If you sign up to hear about new course dates, we store your first and last name, email address, phone number (if you give one), city and country, the language of the emails and the time of your consent. We only write to you after you confirm your address with the link in our confirmation email (double opt-in). The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with the unsubscribe link in every email; we then delete your data. Unconfirmed sign-ups are deleted automatically after 48 hours. The data is stored in Cloudflare Workers KV; the emails are sent through Purelymail.

Event sign-ups

When you sign up for one of our free online sessions, we process your first and last name, your email address and the session you chose, to send you the confirmation and the link to the session (Art. 6(1)(b) GDPR). Sign-ups are stored in Cloudflare Workers KV and deleted automatically two days after the session; we are told by email.

Protection against spam and abuse

The contact form, the course registration, the event sign-up and the sign-up for course dates are protected by Cloudflare Turnstile, which checks whether a request comes from a person. Turnstile processes technical data such as your IP address and browser characteristics for this purpose only (Art. 6(1)(f) GDPR). To limit abuse, we count requests per sender and per IP address for one hour. We store only a one-way hash of an IP address, never the address itself.

Cookies and analytics

We do not use cookies for tracking or advertising. Your accessibility and colour-mode choices are stored in your browser's local storage, never sent to us, and you can clear them at any time.

We measure how the website is used with Cloudflare Web Analytics (Cloudflare, Inc., see above). When a page loads, a small script reports the page address, the referring page, your browser, operating system and device type, your country, and how quickly the page loaded. Cloudflare Web Analytics sets no cookies, does not store IP addresses and does not recognise you across visits or websites; we see only totals (Art. 6(1)(f) GDPR).

Recipients and transfers outside the EU

Your data is received only by the service providers named above, who process it on our behalf, and by the banks involved. We do not sell data. Where service providers process data in the USA, the transfer is based on the European Commission's adequacy decision for the EU–US Data Privacy Framework (Art. 45 GDPR) and, in addition, on standard contractual clauses (Art. 46(2)(c) GDPR).

Your rights

You have the right to access the personal data we hold about you (Art. 15 GDPR), to have it corrected (Art. 16) or deleted (Art. 17), to restrict its processing (Art. 18), to receive it in a portable format (Art. 20), and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future. To exercise any of these rights, email hello@jawohl.org.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the state or country where you live or where we are based.

We do not use automated decision-making, including profiling.

Changes

We update this policy when our services or the law change. The date at the top shows when it was last revised.