Skip to content

Privacy Policy

Machine translated. The German version is authoritative.

1. Controller

The controller for the data processing on this platform is:

Endrik Reimer, trading as “Bildungszeit”, Mühsamstraße 72, 10249 Berlin, Germany
Email: kontakt@bildungszeit.app

For data protection questions you can reach us at datenschutz@bildungszeit.app.

2. What this platform is for

Bildungszeit helps you find accredited Bildungsurlaub courses (statutory educational leave under German state law), request a place with providers and prepare the application to your employer. You are not legally obliged to provide us with any data. Without the mandatory details of a step, however, we cannot carry it out, and without the details requested at registration a provider cannot conclude a contract with us. What concerns only course providers is mainly set out in sections 7 and 17, and what concerns the contact person at the employer in section 6.

3. Which data we collect and when

While you browse and compare (course search, saved list, comparison) we do not collect any data that directly identifies you. We store your selection (for example federal state and topics of interest) under a randomly generated usage identifier. We also keep the language you have chosen for the interface there, so that links in our emails take you to the platform in that language. Since 21 September 2026 we no longer store the text of your search queries there; records created before that date may still contain it. How we process it is described in sections 12 and 13. The usage identifier itself allows no conclusions about your identity; however, if you later submit a participation request, we assign your email address to the same record. When the usage identifier is created we also process your IP address briefly in order to limit automated abuse (section 13).

We only ask for your email address once you submit a participation request. If you ask a provider a question beforehand, we only ask for your email address if the provider needs it in order to reply, and only with your explicit consent. We only ask for your name once you prepare the application to your employer.

The legal basis is the performance of pre-contractual measures and the provision of the services you requested (Art. 6(1)(b) GDPR), and for the question feature your consent (Art. 6(1)(a) GDPR).

4. Requests to course providers

When you submit a participation request, we first inform the provider in pseudonymised form: the provider receives neither your name nor your email address, only the key details of the request (course, date, course location) and, if you write one, your message with it (section 5). Only once the provider has confirmed, your employer has approved or its approval is deemed granted under the law of your federal state, and you yourself send a booking request, do we transmit to the provider your name, your email address and, if you write one, your message. This allows the provider to reply to you and complete the registration with you; your email address is the reply address. This also applies if the provider accepts registrations via its own booking page and we forward you there. The provider processes this information as an independent controller. If you report a problem with a booking, we store your description and inform the provider concerned; so that the provider can answer you, your email address is included as the reply address. The legal basis is the provision of the service you requested (Art. 6(1)(b) GDPR). If you accessed the course page via a link that the provider received for sharing, and made your first request for this course from there, we note this on the request. The provider pays no commission for such a booking; the note serves only this billing (Art. 6(1)(f) GDPR).

If you tell us in the dashboard that your booking has been completed, we also use this information to bill the provider correctly. To that extent, the legal basis is our legitimate interest in correct billing (Art. 6(1)(f) GDPR).

5. Messages to providers

You can ask providers questions via the platform. Detected contact details in messages (such as email addresses, phone numbers or links) are masked automatically before delivery until you have sent a booking request for the course; the detection is rule-based and may miss individual details. From the booking request onwards, we deliver messages in the conversation about that course unchanged in both directions; messages that were delivered masked before then remain masked. The provider also receives your message by email in the delivered form, with long messages shortened. The original message text remains stored with us so that the history stays traceable. Please do not share sensitive data in messages.

6. Application to your employer

If you use the employer application, we collect the details that go into the application: your first and last name and your postal address, the company name and address of your employer, the name and email address of a contact person there, the tone you choose and, if you wish, a personal text and your changes to the application text. If you have the application package sent to an additional email address as well (for example your work address), we also process that address. If you have the cheat sheet for the conversation with your employer sent to a different email address, we use that address only for this delivery and do not store it with your case. We use this data to create and transmit your application on your behalf and to show its processing status. The legal basis is the provision of the service you requested (Art. 6(1)(b) GDPR) as well as our and your legitimate interest in verifiable delivery (Art. 6(1)(f) GDPR).

As proof of delivery we log when the application was delivered, opened and decided, including the IP address used when it was opened and decided. Once a decision has been made or you claim in the dashboard that approval is deemed granted, we send you this information as a delivery log by email. The application email and the application page link to this privacy policy.

If you are the contact person at the employer: we received your name and email address from the applicant. We process them together with the delivery status of the application email, your decision, any reasons given and, if you open the application via the link or decide there, the time and IP address. The purpose is to transmit the application to you and remind you of it, to receive your decision and to prove its receipt. The applicant receives your decision and the delivery log. The legal basis is the legitimate interest of the applicant in submitting the application and proving its receipt, and our legitimate interest in a verifiable transmission (Art. 6(1)(f) GDPR). We delete this information together with the application (section 15); this does not cover the delivery log the applicant has already received. Your rights, including the right to object, are set out in section 16.

7. Course providers: courses, accounts and billing

We publish providers' courses on Bildungszeit and forward participation requests and booking requests to them. For this we process the course data and the provider's master data, such as name, contact details, website and booking channel, as well as the provider's response time to enquiries as measured by us, which we may show to users. We pass on course information and recognition evidence to users and, with their application, to their employers. If the provider has concluded a contract with us under the Provider Terms, the legal basis is performance of a contract (Art. 6(1)(b) GDPR). Otherwise, the legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in showing providers' courses and forwarding participation requests and booking requests to them; for the response time, the legal basis is always our legitimate interest in showing users how quickly a provider responds to enquiries. Where the data do not come from the provider itself, we collected them from publicly accessible sources, in particular course directories, provider websites and directories of the federal states.

Providers register with their company name, the name of a contact person and an email address, and can complete their profile in the provider portal, for example with a website, a logo and a self-description. As proof of the conclusion of the contract we store when it was declared at registration that the registering person acts on behalf of an education provider and not as a private individual, and which version of the Provider Terms we referred to at that time, as well as the time of activation and the agreed version. For signing in with a one-time code we store sign-in timestamps, session data and the delivery status of the code email. To protect against abuse we limit registration and sign-in attempts and store pseudonymised check values for this purpose, for example of the IP address. The legal basis is performance of the contract with the provider and, before activation, the implementation of pre-contractual measures (Art. 6(1)(b) GDPR). For contact persons who are not themselves a party to the contract, and for protection against abuse, it is our legitimate interest in working with the provider and in secure operation (Art. 6(1)(f) GDPR).

For each booking request sent we store a booking item with course, date, course price and commission, whether the booking came about via the provider's offer link and, where applicable, the marking that the booking did not come about, regardless of whether the provider has an account in the provider portal. For each monthly overview of pre-registered bookings sent we store the date of dispatch, the date of receipt and the end of the objection period. If the provider has concluded a contract with us under the Provider Terms, this information is the basis of the monthly overview and of the statement of account, and the legal basis is performance of a contract (Art. 6(1)(b) GDPR), after the contract has ended for the enquiries and pre-registered bookings still processed and included in the statement of account. Otherwise, the legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in being able to prove to the provider which booking requests we forwarded to them and which overviews we sent them. Our tax adviser also receives invoices and the related billing information, to the extent that we need them for our bookkeeping and our tax obligations (Art. 6(1)(c) and (f) GDPR).

Where we base course data, master data, the response time, booking items and dispatch dates on our legitimate interest, you may object to this processing at any time under Art. 21 GDPR on grounds relating to your particular situation (see section 16). If you object to the publication of your courses, we take them offline.

8. Cookies and browser storage

We use exclusively technically necessary cookies and no tracking or marketing cookies:

  • bz_session: keeps your session as a user alive (lifetime 30 days).
  • bz_provider_session: keeps the session in the provider portal alive (lifetime 60 days, contains only a random identifier).
  • bz_provider_login: during provider sign-in, remembers for at most ten minutes the email address the login code was sent to (signed, only for the sign-in process).
  • bz_provider_prefill: remembers for at most ten minutes the previously entered email address when you change it during provider sign-in, so the sign-in form can be prefilled (signed, only for the sign-in process).
  • bz_provider_ziel: remembers for at most 30 minutes which request or conversation you want to return to after provider sign-in when you come from an email from Bildungszeit (signed, contains only an identifier, only for the sign-in process).
  • bz_admin_session: session in the internal operator area (lifetime 8 hours).
  • NEXT_LOCALE: stores your language choice (German/English); it is set as soon as you switch the language or open the English version, and expires when you close your browser.

The legal basis for these cookies is § 25(2) no. 2 TDDDG (the German Digital Services Data Protection Act) in conjunction with Art. 6(1)(b) and (f) GDPR. For purely functional purposes we also use your browser storage, for example for your recent searches, dismissed notices, display settings and your approval of embedded maps and videos (sections 10 and 11); this data does not leave your browser. The same legal basis applies to it.

9. Hosting and technical service providers (processors)

We use the following service providers, which process personal data on our behalf:

  • Vercel Inc. (USA; not restricted to the EU): hosting and delivery of the platform as well as audience measurement (Vercel Web Analytics, see section 13). When the platform is accessed, Vercel processes technically necessary connection data, in particular your IP address, and for the audience measurement additionally information about usage behaviour.
  • Neon (Databricks, Inc. and Neon, LLC, USA; database in the EU/Frankfurt region): this is where our database is located.
  • Resend (USA; not restricted to the EU): email delivery. To send the emails named in this policy, Resend processes recipient addresses and email content.
  • Cloudflare, Inc. (USA): R2 file storage with its storage location in the EU. This is where course documents of the providers are stored (for example programmes and accreditation notices) as well as course images and provider logos, no user data. In addition, Cloudflare Browser Rendering: when course data is imported in the provider portal (section 12), Cloudflare retrieves pages of the website specified by the provider where needed and returns their content to us. This processes the address and the content of the page, which may also contain the provider's contact details; this service is not restricted to the EU.
  • Sentry (USA; EU data region): error diagnostics and stability monitoring. On every page view Sentry receives a session record (random session identifier, time, software version, browser identifier) and processes your IP address in the process. For a share of requests we transmit performance measurements (processing times and the address accessed), and for every request when you submit, for example, a request or an application. In the event of technical errors we transmit error messages with technical context data (for example browser, time and previously visited pages). Before transmission we remove access links, search terms and information on user identity from performance measurements and error messages, and additionally email addresses from error messages.
  • Google Ireland Ltd. / Google LLC (Google Workspace, based in Ireland and the USA; not restricted to the EU): processing of incoming and outgoing email correspondence when you contact us by email or via the contact form, of business correspondence we send (for example the monthly overview to course providers, see section 7), of appointment bookings via Google Calendar and of video calls via Google Meet (see section 14).

The legal basis for hosting and delivery and for error diagnostics and stability monitoring is our legitimate interest in providing the platform securely and reliably (Art. 6(1)(f) GDPR); for the other purposes, the legal basis stated in the respective section applies. Data processing agreements are in place with these service providers. Where data is transferred to the USA, we base this on adequacy decisions (EU-US Data Privacy Framework) and/or EU standard contractual clauses (Art. 44 et seq. GDPR). You can obtain a copy of the safeguards on request at datenschutz@bildungszeit.app.

10. Map display and address search (Google Maps)

To show course locations we embed Google Maps. The map loads only once you actively enable it (two-click solution). Only then does your browser establish a connection to Google, and Google processes your IP address in the process; this may involve a transfer to the USA. Your approval applies only in this tab and ends when you close it; after that, the map loads only after a new approval. You can therefore withdraw your consent at any time with effect for the future by closing the tab. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

The address search in the provider portal suggests addresses via Google Maps. It runs through our server without consent; your browser does not establish a connection to Google in the process. Google receives from our server only the search query and technical information about the search. Google does not receive your IP address, information about your device or any other information about you or your provider account. Google processes the search query as an independent controller under the Google Maps Platform terms; you can find more information in Google's privacy policy. Google may also process the search query in the USA; Google is certified under the EU-US Data Privacy Framework. As for the other functions of the provider portal (section 7), the legal basis is performance of a contract or the implementation of pre-contractual measures (Art. 6(1)(b) GDPR), and otherwise our legitimate interest in a simple and accurate entry of course locations (Art. 6(1)(f) GDPR).

11. Videos (YouTube, Vimeo)

We load embedded videos only once you actively start them (two-click solution, for YouTube via youtube-nocookie.com). Only then is data transmitted to Google or Vimeo Inc. (USA) respectively. Your approval applies only in this tab and ends when you close it; until then, further videos from the same service also load without another click. You can therefore withdraw your consent at any time with effect for the future by closing the tab. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

12. AI-supported features (OpenAI, Anthropic)

For the course search we use language models from OpenAI (USA): the text you enter into the course search and the texts of the courses are transmitted to OpenAI for this purpose. Please do not enter any personal data into the search field; it is never required for the search. We do not transmit data about your case, such as your email address or your name, to OpenAI.

For preparing and checking course content in the provider portal (for example text suggestions, translation, tagging, the automatic check of submitted course information, the check of uploaded recognition certificates and the import of course data from a website specified by the provider) we use language models from Anthropic (USA). This processes course texts of the providers, in the case of a recognition certificate check the uploaded document with all information it contains and, in the case of an import, also the text of the specified course page. Where needed, we retrieve the specified website via Cloudflare for this purpose (section 9). We also use language models from OpenAI when acquiring course providers (section 17): this processes publicly accessible information about providers and the text of their websites, in order to detect duplicate entries and to classify course offerings.

Both services are used via their API; under the contractual terms of OpenAI and Anthropic, the transmitted content is not used to train their models. We base transfers to Anthropic in the USA on EU standard contractual clauses, and transfers to OpenAI on the safeguards of the data processing agreement concluded with OpenAI (Art. 44 et seq. GDPR); you can obtain a copy of the safeguards on request (section 9). The legal basis is our legitimate interest in a capable search and in preparing and checking course content and recognition certificates (Art. 6(1)(f) GDPR).

13. Search, analytics, audience measurement and abuse protection

To improve the platform we evaluate usage events (for example "request submitted") in pseudonymised form under your usage identifier: without tracking cookies and without disclosure to third parties. The text of your search queries is not stored for this evaluation; technical logs contain only a shortened identifier (hash) and the number of search terms. To protect against automated abuse we also limit the access frequency to individual functions, such as the search, the contact form and the creation of a usage identifier; the IP address required for this is held only transiently in memory and discarded after a few minutes; for registration and sign-in in the provider portal, section 7 applies, and for failed sign-in attempts in the internal operator area we likewise store a pseudonymised check value of the IP address. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR).

In addition, we measure the reach of our website using Vercel Web Analytics, a service provided by Vercel Inc., our hosting provider already named in section 9. This records the pages accessed, the referring website, an approximate region of origin as well as device and browser class, plus individual events about the course of use (for example "comparison opened"). This measurement works without cookies: nothing is stored on your device and nothing is read from it; recognition during a visit relies on an identifier formed on the server which is discarded after 24 hours. We only see aggregated figures and cannot attribute them to any person. Parts of the address bar that could contain personal information are removed before transmission: the access links to your case and the text of your search queries do not reach this service. The legal basis is our legitimate interest in privacy-preserving audience measurement (Art. 6(1)(f) GDPR).

14. Contacting us

If you contact us by email or via the contact form, we process the details you provide (email address, optionally your name, content of the message) in order to handle your enquiry. The legal basis is the provision of the service you requested or our legitimate interest in responding (Art. 6(1)(b) and (f) GDPR).

On our page for course providers you can book a call with us via Google Calendar. The booking is only linked there, not embedded: when you open our page, no data is transmitted to Google for this purpose. Only when you click the link does your browser establish a connection to Google, and Google processes your IP address in the process; this may involve a transfer to the USA. If you book an appointment, Google, as our processor (Google Workspace, see section 9), processes the details you enter and the chosen time. If we hold the call by video, we use Google Meet; Google, as our processor, processes image, sound and connection data in the process. We use these details to arrange and hold the call with you. The legal basis is the same as when you contact us by email (Art. 6(1)(b) and (f) GDPR).

15. Retention periods

We store the details of your case (for example your check-in selection, your saved list, requests, messages and the employer application including its delivery log) until you delete them yourself in the dashboard or ask us to delete them (see section 16). The dashboard is available to you once you have submitted a participation request or sent a question to a provider. We delete details for which you have not provided an email address 60 days after your usage identifier was created. We delete the details of the contact person at your employer together with your application. We delete the IP information in the delivery log twelve months after your employer's decision, and at the latest together with your application. We store a provider's data (see section 7) for as long as its provider account exists and, without an account, until the provider asks us to erase it; on request we anonymise it (right to erasure, see section 16). Booking items for booking requests we have forwarded to a provider, the dispatch dates of the monthly overviews and the details of the conclusion of the contract (section 7) remain stored even after the anonymisation, because they are the basis for the statement of account or proof towards the provider; the provider's record remains in anonymised form for this purpose. The links in our emails that open your dashboard are valid for 30 days from sending and, for open or confirmed participation requests, as a rule until twelve months after the last course day. Deleting your data (see section 16) invalidates them immediately. Copies that recipients have already received (for example your employer or a provider) are not covered by a deletion on our side. Statutory retention obligations (for example for invoices) remain unaffected.

16. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent you have given at any time with effect for the future. Please contact datenschutz@bildungszeit.app for this. Once the dashboard is available to you (see section 15), you can also delete your data yourself there at any time; this deletion takes effect immediately and is permanent.

Right to object: where we base processing on our legitimate interest (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). An informal message to datenschutz@bildungszeit.app is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information), Alt-Moabit 59-61, 10555 Berlin, www.datenschutz-berlin.de. You can also contact the supervisory authority of your habitual residence.

17. Providers and prospects (business contacts)

To acquire course providers we process business contact data (name, business email address, phone number, role, postal address) from publicly accessible sources, in particular course directories, provider websites and directories of the federal states. In addition we keep our own notes on the approach (call notes, outcome and preferred contact channel). To classify and de-duplicate this information we use the AI services named in section 12. The legal basis is our legitimate interest in approaching suitable providers for our marketplace (Art. 6(1)(f) GDPR). We use this data for business contact and do not pass it on; where we also use a provider's course data and master data to publish its courses, section 7 applies to that use. We delete it when it is no longer needed or when you object. You can object to this processing at any time at datenschutz@bildungszeit.app; we meet the information obligations under Art. 14 GDPR through this policy and the notice in our first contact.

18. Changes to this policy

We adapt this policy when the platform or the legal situation changes. The version published here at the time applies.

Last updated: 20 October 2026