Privacy policy

PassionFlow Ltd, Meteoron 18, 8250 Paphos, Cyprus
Email: kontakt@coursekit.de

This policy applies to the coursekit.de website, registration and CourseKit's contractual, billing and support relationship. For member data in a member area at customer.coursekit.de or a custom domain, the respective course provider is the controller; CourseKit processes that data on their behalf under the DPA.

When you visit, our hosting provider processes technically necessary data: IP address, time, requested address, browser identifier and amount of data transferred. This serves the delivery and security of the website (Art. 6(1)(f) GDPR). If a technical error occurs, the server or the browser sends an error report to our error monitoring (Sentry, EU data region): page path, browser and system version and the technical error trace - without a stored IP address, cookies or form contents. This is how we find and fix errors (Art. 6(1)(f) GDPR).

The hosting provider is Vercel Inc., USA. The website is delivered from the Frankfurt region. For transfers to the USA we rely on the adequacy decision for the EU-US Data Privacy Framework and additionally on standard contractual clauses.

We use no third-party analytics; advertising services only with your consent (Google Ads, see below). We count page views ourselves, without cookies and without storing anything in your browser: after a page has loaded, your browser sends us the page path, the website you came from (we keep only its domain), campaign details from the address (utm_source, utm_campaign) and, where present, a partner code from the link. All that remains are daily counts. In the same way we count whether the cookie window was open and how you decided in it – without a cookie and without any link to you, only as a daily total. When you click on through our website, we append the campaign details and the page you arrived on to the address of the next page, so they are still there when you sign up – again without storing anything in your browser. We do not store your IP address; we check the browser identifier only to filter out search engine robots and do not store it either. These general daily counts do not identify individual visitors (Art. 6(1)(f) GDPR). Contact-linked signals on personal pages are described separately in section 6. All fonts are served from our own server; no connection to Google or other font providers is made for them.

Google Ads (conversion measurement and remarketing)

Only on coursekit.de, never in a member area, on a customer's own domain, in the admin areas or in the partner portal, and only with your consent – when you choose “Accept” or switch on Marketing in “Cookie settings”. Before that, nothing is loaded from Google. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

After that, your browser loads the Google tag (gtag.js) from Google's servers; this transmits your IP address and browser information. Google sets cookies on coursekit.de (_gcl_au and, on a visit from an ad, _gcl_aw and _gcl_gb) that store the identifier of an ad click for up to 90 days. We count three events as conversions: a visit of 20 seconds or a second page viewed, a click on a link to the sign-up and a sent sign-up form. This tells Google which ad led to them; we see aggregated numbers only. With remarketing, Google adds you to audience lists so that we can show you CourseKit ads again in Google Search and on other websites; we do not see who is on a list. In Google's consent mode, ad_storage, ad_user_data and ad_personalization are set to “granted” after your consent and analytics_storage to “denied”, so Google Analytics is not used. We transmit no name, email address or account data to Google.

If you sign up after arriving from an ad and giving your consent, we store the identifier of that ad click (from the _gcl_aw or _gcl_gb cookie) with your sign-up. When you then sign in to your account for the first time or pay your first invoice, we report this identifier to Google with the time and a fixed value (“Kunde bestätigt” or “Kunde zahlt”), so Google learns which ads lead to real customers. We do not transmit your name, e-mail address, payment details or amounts. Without consent or without an ad click we store no identifier. We delete the stored identifier 90 days after the click; if you withdraw your consent after signing up, drop us a line and we delete it at once.

The purpose is to measure which ads lead to sign-ups and paying customers, to steer the ad budget and to address earlier visitors again. The legal basis is your consent (§ 25(1) TDDDG and Art. 6(1)(a) GDPR). Google LLC in the USA may process data; the transfer rests on the EU-US Data Privacy Framework (Google LLC is certified) and additionally on the EU standard contractual clauses. Storage: the cookies up to 90 days, a click identifier stored with a sign-up 90 days from the click, your choice 12 months, membership of audience lists as configured in Google Ads, at most 540 days (Google's maximum).

You can withdraw your consent at any time with effect for the future: via “Cookie settings” at the foot of every page of coursekit.de. This removes Google's cookies on coursekit.de.

More in Google's privacy policy.

We set cookies only on the basis of your own decision. If you choose a language yourself, we store that choice in a cookie (ck_locale, valid for one year). It is technically necessary for the function you requested and contains nothing but the language code (§ 25(2) TDDDG). If you make a choice in the cookie window, we store it in a cookie (ck_consent): “necessary” or “Marketing”, valid for 12 months, only on coursekit.de (not on subdomains) and passed to no other provider. It is necessary to carry out your choice (§ 25(2) no. 2 TDDDG) and as proof of your consent (Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR).

If you sign up for early access, we process your email address to inform you about the launch of CourseKit. The legal basis is your consent (Art. 6(1)(a) GDPR).

Double opt-in: After you sign up we send you an email with a confirmation link. Until you click it we do not store the address – it is only contained, encrypted, in that link, which becomes invalid after 48 hours. Only after confirmation do we add the address to our contact list.

To prevent abuse we count sign-up attempts per IP address and per email address. Both are only kept as a check value (hash) in memory, discarded after two days at the latest and never stored (Art. 6(1)(f) GDPR).

Sending and the contact list run via Resend Inc., USA, as a processor. The same safeguards as in section 2 apply to the transfer.

You can withdraw your consent at any time – via the unsubscribe link in our messages or with an informal message to us. We then delete the address, at the latest once the waitlist has served its purpose with the launch.

When you use a contact form, we process your name, email address, optional platform or website and message to answer the enquiry (Art. 6(1)(b) or (f) GDPR). The information is emailed to CourseKit; an enquiry does not sign you up for the newsletter, and there is no automatic confirmation.

An enquiry through one of our contact forms – “Question about CourseKit” or the migration form – is also recorded in our customer management – name, email address, platform and message – so that we can handle and follow it up (Art. 6(1)(b) GDPR). If a CourseKit sales partner can support you better, we hand the enquiry over to them; they receive the same information and get in touch with you (Art. 6(1)(b) and (f) GDPR); if you write to us again afterwards, they receive that enquiry too. You can object to this storage and handover at any time (Art. 21 GDPR) – a short message to us is enough. We delete the enquiry once it is settled and no retention duty applies, at the latest 12 months after the last contact, or as soon as you ask us to.

When you report illegal content through the report form, we process the content's address, your explanation and – if given – your name and email address to review the report, confirm receipt and tell you our decision. This is a legal obligation under Art. 16 of Regulation (EU) 2022/2065 (Art. 6(1)(c) GDPR). We inform the provider concerned about the report; we disclose your name and address only where that is strictly necessary to resolve the matter. We keep the report and the decision as evidence for as long as claims arising from them can be asserted.

For deduplication and delivery control we only store a non-reversible request ID, concern, delivery status and timestamps. The message, name and email address are not kept in this log. For abuse prevention, the IP address is held only briefly as a hash in memory.

Delivery uses Resend Inc. as a processor. The validated visitor address is used only as the reply-to address of the internal email.

The “Book a 15-minute call” button lets you book a short call with us. The booking page is a Google Calendar appointment schedule (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland); only your click on the button opens it, and without your consent (section 3) nothing from Google is embedded in our own pages. There you enter your name, email address and the time you want, and a short message if you like. Google passes the booking to us and sends you and us the confirmation. We use the details to prepare and hold the call (Art. 6(1)(b) GDPR). Depending on the service, Google processes the booking as a processor or as a controller in its own right, including in the USA; the EU-US Data Privacy Framework applies. We delete the appointment and the details once the request is settled and no retention duty applies, or as soon as you ask us to.

PassionFlow Ltd, the provider of CourseKit, is responsible for its own handling of prospects, platform operation and commission accounting; our contact details are in section 1. An independent referral partner handles their own contacts under their own responsibility. Their name and contact details appear on the personal page or their contact form. CourseKit provides their technical lead management. Using this tool alone does not disclose their contacts to CourseKit for its own sales purposes.

We or our partners record names, businesses or practices, business email addresses, phone numbers, postal addresses and the source of the contact details. These come from information you provide, personal contact, referrals or public sources such as business websites. Organising business contacts relies on legitimate interests (Art. 6(1)(f) GDPR); taking pre-contractual steps you request relies on Art. 6(1)(b) GDPR. This does not replace any required marketing consent. A recorded website may have its public home page checked automatically; the detected course platform and a downsized logo are stored.

Lead management also holds conversation notes, handling status, appointments and associated messages. When a mailbox is connected, incoming and outgoing emails are matched against that mailbox owner’s contacts; only matching messages are associated with leads. If storing message text is enabled, the reply without quoted previous messages is stored up to 10,000 characters. Sales emails are sent through the sender’s mailbox. A partner can share their basic lead details with CourseKit for read-only access; activities and notes require a separate additional sharing setting. Both settings are off by default.

Personal pages at coursekit.de/i/… are associated with a contact through an individual link identifier. We record page views, demo openings and calculator use against that contact, without setting cookies or storing IP addresses for this purpose. We rely on our legitimate interest in handling the contact (Art. 6(1)(f) GDPR); you may object. A submitted question, including name, email address and message, goes to the contact person named on the page; for a partner’s contact it is not additionally sent to CourseKit’s operators. Access requests also go to CourseKit to set up access. Calculator results are transmitted only when you explicitly submit them. We handle your requested enquiries under Art. 6(1)(b) or (f) GDPR.

Voluntary email or phone contact consent covers the senders and channels named in the declaration (Art. 6(1)(a) GDPR). Both the personal page and the general consent form send a confirmation link to the relevant address; consent is recorded only after explicit confirmation. Before that, a temporary request with contact details, selected channels and text version is stored. The link is valid for seven days. The request is deleted on confirmation; older unconfirmed requests are cleaned up when subsequent requests are made. As evidence we record the time, channels, text version, entry method and withdrawal (Art. 6(1)(f) with Art. 7(1) GDPR). You can withdraw at any time through the withdrawal link or by contacting us.

An objection to further approaches or a withdrawal blocks the email address across the platform. We store a check value created with a secret key (HMAC). The block list contains neither the address in plain text nor a reason or the reporting partner. The value is pseudonymous, not anonymous: an address entered again can be checked against it. This helps us honour your objection and prevent further unwanted approaches (Art. 6(1)(f) and Art. 21 GDPR).

When you are attributed to a partner, that partner receives your member-area name or business name, plan, commission-relevant contract status, net payments and their commission to check and settle their commission (Art. 6(1)(f) GDPR). Attribution is shown alongside the partner code or the existing partner assignment. The accounting view contains no course content, member data or detailed usage data.

Contact details, messages and page activities are needed to handle the contact and are to be deleted once it is settled, unless another purpose or retention duty applies. After withdrawal, only necessary evidence and blocking information may remain: evidence for as long as needed to clarify or defend claims, and blocking values for as long as needed to honour the objection. Commission and accounting records are also subject to statutory retention duties. There is no general automatic deletion period for all lead data. Section 10 covers technical providers and international transfers; questions and rights requests can be sent to the address in section 1.

At registration we process the member-area name, subdomain, email address, language, invite or referral code, and the accepted versions of the terms and DPA. This is necessary to take steps before and perform the contract (Art. 6(1)(b) GDPR) and to prove the agreements (Art. 6(1)(f) GDPR). Contract and evidence records are retained as legally required; operational account data is first locked for 30 days after a deletion request and then deleted unless retention is required by law. If you do not sign in to your member area within 7 days of registering, we delete it with all data stored for it; database backups keep it for up to 30 days and are then overwritten. After 3 days we remind you once by email; the reminder contains only the sign-in link and the deletion date. We store the time of your first sign-in as proof that the registration came from you (Art. 6(1)(f) GDPR).

If you came to us through a link with campaign details (utm_source, utm_medium, utm_campaign – from an ad, for example), we store these details with your account at sign-up, together with the page of our website you arrived on. This shows us which channels and ads lead to customers (Art. 6(1)(f) GDPR; legitimate interest in assessing our advertising). The details come from the link's address alone: no cookies are set for this and nothing is stored in your browser; they are not passed to advertising providers. Google Ads on coursekit.de is separate from this and described in section 3. After your account is deleted they remain only as part of our statistics, without name, email address or subdomain.

During and after the trial we send notes to your account's email address on the setup – which steps are still open and how to use what you signed up for –, on the end of the trial – when it ends, what then happens to your data and how to choose a plan – and on our plans: if you have not chosen a plan after the trial, we write to you up to twice that your member area is still there and how to go on, and briefly ask what held you back. These emails contain no newsletter. The legal basis is the performance of the trial contract (Art. 6(1)(b) GDPR) and our legitimate interest in making your start easier and presenting our plans to you (Art. 6(1)(f) GDPR); we point this out when you sign up (Section 7(3) UWG). You can object to these emails at any time without incurring any costs other than the transmission costs at the basic rates: through the unsubscribe link in each of these emails, through your email program's unsubscribe function or with an informal reply. We store when and in which version you were shown the notice and, after an objection, when and how you objected (Art. 6(1)(f) GDPR); after that we send no more such emails. Emails your account needs, such as sign-in links and notices about your plan, keep coming regardless. Sending runs through Resend (section 10). We delete this information together with your account.

A person choosing optional Google sign-in is redirected to Google. CourseKit requests only openid, profile and email and receives the name, email address and a stable provider identifier. Google access, refresh and ID tokens are not stored; CourseKit does not access Gmail, Drive or other Google services. Google processes the sign-in under its own terms. Signing in with a one-time email link is always available as an alternative.

For billing we process the invoice recipient, billing email, address, country, optional VAT ID and its VIES verification status, and plan, invoice, payment and credit data. The legal bases are contract performance and statutory tax and accounting duties (Art. 6(1)(b) and (c) GDPR). Stripe Payments Europe, Limited processes payment, invoicing and fraud-prevention data as processor or controller depending on the activity. CourseKit does not store card or bank details. Tax and invoice records are retained for the statutory period; OSS records, where applicable, for ten years.

We use Vercel, Neon, Resend, Sentry and Stripe for hosting, database, email, error monitoring and billing, and Google for booking a call and, with your consent, for ad measurement (sections 3 and 5). Where data is processed outside the EEA, an adequacy decision such as the EU-US Data Privacy Framework or Standard Contractual Clauses and supplementary measures where required apply. Processors handling member data are also identified in the public sub-processor list for the DPA.

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR) as well as the right to withdraw consent with effect for the future. You can also lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live.

A message to kontakt@coursekit.de is enough.