Privacy policy
1. Controller
Saage Media GmbH, represented by its Managing Director Rico Saage, c/o SpinLab – The HHL Accelerator, Spinnereistraße 7, 04179 Leipzig, Germany. Email: EconomyTutor@saagemedia.com.
We have not appointed a data protection officer because there is currently no obligation to do so under Section 38 of the German Federal Data Protection Act (BDSG). We process personal data only to the extent necessary to operate the website, answer inquiries or comply with legal obligations (Art. 6(1) of the EU General Data Protection Regulation, GDPR).
2. Hosting and server log files
The website runs on WordPress at Hostinger (Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaca, Cyprus, or the Hostinger company named in the data processing agreement) as our processor (Art. 28 GDPR). Hostinger’s content delivery network (CDN) sits in front of the website. The domain is managed by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany; its name servers only answer your device’s technical address lookup.
Each time you access the website, we process technical data in server log files: IP address, date and time, requested address, status code, amount of data transferred, referrer and browser identifier (user agent). The purpose is to deliver the website securely and reliably and to fend off attacks; the legal basis is Art. 6(1)(f) GDPR. We keep the log files only for as long as necessary for this purpose.
3. Cookies and local storage
When you visit the website, we do not set any cookies. We use no advertising and no tracking; the cookieless page statistics are described in Section 4. Fonts and images are hosted on our own server; there is no connection to Google Fonts or other third parties. The search on the lessons page runs entirely in your browser; what you type is not transmitted.
Course progress: When you take a quiz or choose a learning mode in the course, your browser saves your progress (lessons done, quiz scores, start date and mode of the daily plan) in your device’s local storage (entry „et-course-v1“). This information stays on your device and is not transmitted to us. You can delete it with „Reset progress“ on the course page or in your browser settings.
Course access: After buying the course, or when you open your personal access link, we set the cookie „et_course_access“. It contains a random key that unlocks the course in this browser and is stored for up to 400 days. On our server, the key is stored only as a hash.
Both are strictly necessary for the functions you have requested (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG).
4. Page statistics
To understand how often and through which routes our pages are visited, we use the statistics software Koko Analytics. It runs as a WordPress plugin on our server at Hostinger (Section 2). There is no external analytics service; the data is not passed on to third parties.
How counting works: When a page is loaded, a small script in your browser reads the address of the page and the address of the referring page (referrer) if you come from another website, and sends them to our server. Only daily counters per page and per referring website are stored. Nothing is stored in your browser in the process: no cookies, no local storage, no other identifiers.
How visitors are distinguished: So that the same visitor is not counted more than once on the same day, our server creates a hash from your IP address, your browser identifier (user agent) and a random daily value. Your IP address is not stored for this purpose. At midnight (German time), the daily value is changed and all hashes are deleted. This makes it impossible to recognize visitors across several days or to create profiles of individuals.
Legal basis and retention: Our legitimate interest in designing the website to meet visitors‘ needs and in understanding its reach (Art. 6(1)(f) GDPR). The daily counters contain no personal data; we delete them automatically after 36 months. We do not count visits by logged-in administrators.
Objection: You can object to the counting at any time (Art. 21 GDPR). To do so, click „Turn off statistics on this device“ below. Your browser then saves a note in its local storage, and the statistics script no longer sends anything from this device. The note is not transmitted to us; storing it is strictly necessary for your objection (Section 25(2) no. 2 TDDDG). If your browser sends the „Global Privacy Control“ signal, we do not count you either.
5. Links to YouTube and social networks
The website does not embed videos. Links to YouTube and to our social media profiles are simple links. Only when you follow such a link do you leave our website; the respective provider is responsible for any data processing there.
6. Buying the course via Paddle
You conclude the purchase contract with Paddle. Depending on the country from which you make your purchase, the contracting Paddle company is Paddle.com Market Limited, 30 Old Bailey, London EC4M 7AU, United Kingdom, Paddle.com Inc. (USA) or Paddle.com (Canada) Ltd. (Canada). Paddle is the seller (Merchant of Record) and an independent controller for the processing in the checkout; Paddle’s privacy notice applies: paddle.com/legal/privacy.
Before the checkout opens, we ask for your consent to the immediate start of the supply in a dialog. Only when you select „Continue to checkout“ there does your browser load the Paddle.js program from Paddle; your IP address and technical data about your browser are then sent to Paddle. Before that, there is no connection to Paddle. In the checkout, Paddle may set cookies or process device data for payment processing and fraud prevention; Paddle is responsible for this.
After payment, we receive from Paddle what we need to provide the course, as proof and for support: email address, transaction number, time of payment, amount and currency and, if Paddle provides it, your name. We store this data in an access record together with the time and wording of your consent and a hash of your access key. The legal basis is Art. 6(1)(b) GDPR (provision of the course) and, for keeping proof of your consent, Art. 6(1)(f) GDPR. We store access records for as long as the access exists and then until the end of the third calendar year (statutory limitation period, Sections 195 and 199 BGB); records we must keep for commercial or tax law reasons are retained as required by Section 257 HGB and Section 147 AO.
7. Emails about your access, withdrawal form
After the purchase, we email you your personal access link and the confirmation of your purchase and consent (Art. 6(1)(b) GDPR). If you request a new access link on the course access page, we process the email address you enter in order to send the link if it belongs to a purchase; to prevent misuse, the number of requests per IP address is limited for a short time, using a hash of the IP address that is deleted after one hour (Art. 6(1)(f) GDPR).
If you withdraw using the „Withdraw from contract“ form, we process your name, email address, the order number, any optional message and the time of receipt in order to confirm receipt to you, to prove the withdrawal and to forward it to Paddle (Art. 6(1)(b) and (c) GDPR). We keep withdrawals together with the acknowledgement of receipt until the end of the third calendar year after receipt (Art. 6(1)(c) and (f) GDPR).
Emails are sent from our website at Hostinger; replies and our mailbox are handled by Google (Google Workspace, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) as our processor.
8. Contact by email
If you write to us, we process your details (name, email address, message, time) in order to answer your request (Art. 6(1)(b) or (f) GDPR). Our mailbox is operated by Google Workspace as our processor (Section 7). We delete requests six months after they have been dealt with, unless we are required to retain them.
9. Countries outside the EU and retention period
Paddle.com Market Limited is based in the United Kingdom; the European Commission has adopted an adequacy decision for the United Kingdom. If you buy from the United States or Canada, your data may be transmitted to Paddle.com Inc. (USA) or Paddle.com (Canada) Ltd. Under its contract, Hostinger processes the data in the EU or the EEA. Where service providers use sub-processors in countries outside the EU or the EEA, this is done on the basis of adequacy decisions or standard contractual clauses; Google LLC is certified under the EU-U.S. Data Privacy Framework (adequacy decision of July 10, 2023, Art. 45 GDPR). We store data only for as long as necessary for the purpose or required by law. There is no automated decision-making, including profiling (Art. 22 GDPR).
10. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). To exercise them, write to EconomyTutor@saagemedia.com.
Right to object (Art. 21 GDPR)
Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then no longer process the data unless we demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defense of legal claims.
You can lodge a complaint with a supervisory authority, for example the authority responsible for us, the Saxon Data Protection and Transparency Commissioner (Sächsische Datenschutz- und Transparenzbeauftragte), Maternistraße 17, 01067 Dresden, Germany (postal address: Postfach 11 01 32, 01330 Dresden), datenschutz.sachsen.de. If you live in the United Kingdom, you can also lodge a complaint with the Information Commissioner’s Office (ICO), ico.org.uk.
11. Security and changes
The website uses an encrypted connection (TLS/HTTPS). We update this policy when the website or the legal situation changes. The version currently published here applies.