ISL Sprachschule Privacy Notice

Last updated 4 October 2026

This notice explains how we process personal data when you visit our website, contact us, enrol on a course or use our online services. Separate information applies to employees and job applicants.

Who is responsible for your data

ISL Sprachschule GmbH & Co. KG
Im Katzentach 4
76275 Ettlingen, Germany
Telephone: +49 (0)7243 938744
Email: info@isl-sprachschule.de

Our Data Protection Officer can be contacted at datenschutz@isl-sprachschule.de or by post at ISL Sprachschule GmbH & Co. KG, For the attention of the Data Protection Officer, Rizzastraße 35, 56068 Koblenz, Germany.

Visiting our website

Our website is hosted on a Netclusiv server in Germany. Technical information is processed to deliver website pages, maintain security and investigate faults or misuse. This may include your IP address, date and time of access, requested pages, browser and operating system information, and the referring page where supplied by your browser.

The legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in providing a secure and reliable website. Hosting and technical support providers may process this information on our behalf. The technical information necessary to deliver pages is required to provide the website to your device. Ordinary server logs are retained for 14 days; relevant entries may be kept longer to investigate a specific security incident or legal claim.

Cookies and external website services

Cookies and similar technologies store or access information on your device. Technologies strictly necessary to provide a digital service you expressly request may be used without consent under Section 25(2) TDDDG. Other device storage or access requires consent under Section 25(1) TDDDG unless another statutory exception applies. Where personal-data processing relies on consent, its legal basis is Article 6(1)(a) GDPR. Consent can be withdrawn at any time without affecting earlier lawful processing. You may contact us to withdraw consent; browser settings also allow cookies to be blocked or deleted. Blocking cookies may affect some functions.

We use Google reCAPTCHA to protect forms against spam and automated misuse, Google Maps to display school locations, and YouTube to present videos. Our purpose in using these services is security and providing information, rather than advertising tracking.

Nevertheless, these services can transmit information to Google, including your IP address, browser or device information, the page accessed and interactions with the service. reCAPTCHA assesses interaction signals and uses cookies. Maps and YouTube may also use cookies or similar technologies. If you are signed into a Google account, Google may associate activity with that account.

For spam prevention, our legitimate interest is protecting our forms against misuse under Article 6(1)(f) GDPR. This does not replace any consent required for device access or other processing. Optional Maps and YouTube processing requiring consent relies on Article 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG.

Google processes information under its applicable service terms and privacy policy, including for its own purposes. Its processing can take place outside the European Economic Area. Provider-side retention and further information are available at https://policies.google.com/privacy. You can also obtain school locations or contact us directly without using embedded maps, videos or a protected website form.

Contacting us and WhatsApp

We process names, contact details, messages and attachments to answer enquiries and manage related communications. For enquiries and communications necessary to arrange or perform a contract, the legal basis is Article 6(1)(b) GDPR. Otherwise, it is Article 6(1)(f) GDPR, based on our legitimate interest in responding to enquiries. Without sufficient information to understand an enquiry and reply, we may be unable to respond.

We use ordinary WhatsApp and WhatsApp Web, without an additional shared-inbox provider. If you choose WhatsApp, we process your telephone number, displayed profile name, messages and attachments for the purposes above. WhatsApp Ireland Limited provides the service in the European Region and processes information under its own privacy notice. This can include device and connection information and processing outside the European Economic Area, including the United States. See https://www.whatsapp.com/legal/privacy-policy-eea.

You may contact us by email or telephone instead. Starting a WhatsApp conversation does not give us permission to send unrelated marketing. Routine enquiries and routine WhatsApp conversations are retained for six months after closure. Necessary student or business records follow the longer applicable periods below.

Course enrolment and student administration

We process personal data to arrange enrolment, deliver courses, administer examinations, manage payments and meet reporting and recordkeeping requirements. Depending on the service, data includes your name, address and contact details; date of birth and nationality where required; course bookings, attendance, assessments and test results; identity-document details where necessary; and bank or payment information where needed.

Contract-related processing relies on Article 6(1)(b) GDPR. Processing required by law relies on Article 6(1)(c) GDPR. Optional processing based on consent relies on Article 6(1)(a) GDPR. We also rely on Article 6(1)(f) GDPR where necessary to protect our systems and establish, exercise or defend legal claims.

We identify information required for enrolment or a particular service when requesting it. Without necessary information, we may be unable to provide that service. Where we receive personal data from another organisation, we provide the applicable information about the source, categories and processing purposes.

Storage systems and recipients

We use Microsoft SharePoint for document storage and collaboration, with our SharePoint data stored in Ireland. We use ABES/Objects for student and course administration on a server in Frankfurt, Germany. Authorised staff and relevant service providers access information where needed for their tasks. Retention depends on the record type, rather than the system used.

Where necessary, recipients include hosting and IT providers, document-storage and communications providers, banks and payment providers, examination bodies, professional advisers, and BAMF or other authorities where disclosure is required by law or applicable funding arrangements. Providers processing personal data on our behalf are subject to the required data-processing arrangements. Other recipients may act under their own responsibility.

Online lessons and meetings

We use Zoom for online lessons, consultations and meetings. Depending on the functions used, data includes names and contact details, connection information, audio and video, chat messages, shared content and responses to polls. Other participants can see or hear information you share. You can control your camera and microphone, although particular lesson activities may require audio or video participation.

The legal basis is Article 6(1)(b) GDPR where a session is necessary to arrange or perform a contract. For other meetings, it is Article 6(1)(f) GDPR, based on our legitimate interest in effective communication. Zoom and its service providers process information needed to deliver the service.

If we record or transcribe a session or use AI features involving participant data, participants receive advance information about the purpose, legal basis and retention. Consent is obtained where required. Routine recordings, transcripts and meeting chats are retained for 30 days. A longer period requires a specific documented purpose communicated to participants. Necessary attendance or course records follow the periods below.

Retention periods

Our retention policy applies the following periods:

·        Routine enquiries and routine WhatsApp conversations: six months after closure.

·        Student administration records needed for potential contractual claims: normally three years after the end of the calendar year in which the course or contract ends, unless another requirement applies.

·        All BAMF-required records, including student details, attendance records and test results: five years, calculated from the starting point specified by the applicable BAMF requirements.

·        Relevant business correspondence: six years under the statutory rules.

·        Invoices and accounting vouchers: eight years under the statutory rules.

·        Accounting books, inventories and annual accounts: ten years under the statutory rules.

·        Ordinary website server logs: 14 days.

·        Routine Zoom recordings, transcripts and meeting chats, if used: 30 days.

Statutory periods generally begin at the end of the relevant calendar year as specified by law. Where several requirements apply to a record, the longer applicable period governs. Relevant records are kept longer where required for an ongoing dispute, audit, security incident or other legal requirement. We delete or anonymise personal data when it is no longer needed. Copies retained in backups are subject to the applicable backup replacement cycle and are not used for ordinary business purposes after deletion from active systems.

Dubai access and international processing

Our Dubai branch is part of ISL Sprachschule GmbH & Co. KG, not a separate legal entity. Authorised ISL employees in Dubai access records where necessary to support students from the regions served by the branch, including India. This access does not include records of EU-resident students. Access is limited to employees’ duties, and ISL remains responsible for security and risks associated with processing outside the European Economic Area.

External services, including Microsoft, Google, WhatsApp and Zoom, may involve processing outside the European Economic Area. A European storage location does not necessarily cover every support or other processing activity. Where a transfer mechanism is required, applicable adequacy decisions or appropriate safeguards under the GDPR govern the transfer. The EU–US Data Privacy Framework applies only to transfers covered by a relevant recipient’s active certification. Other safeguards may include European Commission Standard Contractual Clauses and necessary supplementary measures. Contact our Data Protection Officer for details of the arrangements applicable to your data and how to obtain a copy of relevant safeguards.

Your rights

Subject to the applicable legal conditions, you may request access, correction, deletion, restriction of processing and data portability under Articles 15 to 20 GDPR. You may withdraw consent at any time without affecting processing that was lawful before withdrawal.

Right to object: Where processing relies on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. We will stop processing unless we demonstrate overriding compelling legitimate grounds or need the data for legal claims. You may object to processing for direct marketing at any time.

Contact datenschutz@isl-sprachschule.de to exercise your rights. Where necessary, we may request proportionate information to verify your identity. You may complain to a supervisory authority, including one in the country of your habitual residence, workplace or alleged infringement. For ISL’s registered office, the relevant authority is the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg. Contact details and complaint channels: https://www.baden-wuerttemberg.datenschutz.de/kontakt-aufnehmen/.

Security and updates

We use appropriate technical and organisational measures to protect personal data. Our website uses HTTPS to encrypt information transmitted between your browser and the website. We update this notice when our processing activities or applicable requirements change.