Privacy Policy

Last updated: April 2026

Table of Contents

  • Controller
  • Overview of Processing Activities
  • Relevant Legal Bases
  • Security Measures
  • Transmission of Personal Data
  • International Data Transfers
  • General Information on Data Storage and Deletion
  • Rights of Data Subjects
  • Provision of the Online Offer and Web Hosting
  • Use of Cookies
  • Blogs and Publication Media
  • Contact and Inquiry Management
  • Newsletter and Electronic Notifications
  • Web Analytics, Monitoring and Optimisation
  • Affiliate Programmes and Affiliate Links
  • Presence on Social Networks (Social Media)
  • Plug-ins and Embedded Functions and Content

Controller

Bianca Schmittdiel
Johannes-Gutenberg-Straße 2c
61118 Bad Vilbel
Germany

E-mail address: hello@setcoursewithbibi.com

Legal Notice: setcoursewithbibi.com/legal-notice

Overview of Processing Activities

The following overview summarises the types of data processed and the purposes of their processing, and refers to the data subjects concerned.

Types of Data Processed

  • Inventory data
  • Location data
  • Contact data
  • Content data
  • Contract data
  • Usage data
  • Meta, communication and procedural data
  • Log data

Categories of Data Subjects

  • Prospective customers
  • Communication partners
  • Users

Purposes of Processing

  • Communication
  • Security measures
  • Direct marketing
  • Reach measurement
  • Tracking
  • Target group formation
  • Affiliate tracking
  • Organisational and administrative procedures
  • Feedback
  • Marketing
  • Profiles with user-related information
  • Provision of our online offer and user experience
  • IT infrastructure
  • Public relations

Relevant Legal Bases

The following provides an overview of the legal bases of the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence. Where more specific legal bases apply in individual cases, we will inform you of these in the privacy policy.

  • Consent (Art. 6(1)(a) GDPR) – The data subject has given consent to the processing of their personal data for one or more specific purposes.
  • Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR) – Processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract.
  • Legitimate interests (Art. 6(1)(f) GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

National data protection regulations in Germany: In addition to the GDPR, national data protection regulations apply in Germany, in particular the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG).

Security Measures

We implement appropriate technical and organisational measures in accordance with the legal requirements, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons.

These measures include, in particular, ensuring the confidentiality, integrity and availability of data by controlling physical and electronic access, as well as access, input, transfer, securing of availability and separation of data. We have also established procedures to ensure the exercise of data subjects' rights, deletion of data and responses to data threats.

Transmission of Personal Data

In the course of our processing of personal data, it may be transferred to or disclosed to other bodies, companies, legally independent organisational units or persons. Recipients of this data may include, for example, service providers commissioned with IT tasks, or providers of services and content that are integrated into a website. In such cases, we comply with the legal requirements and conclude appropriate contracts or agreements with the recipients of the data.

International Data Transfers

Where we transfer data to a third country (i.e. outside the European Union or the European Economic Area), this is always carried out in accordance with the legal requirements. For data transfers to the USA, we rely primarily on the Data Privacy Framework (DPF), which was recognised as a safe legal framework by a decision of the EU Commission on 10 July 2023. In addition, we have concluded Standard Contractual Clauses with the relevant providers.

Further information on the DPF and a list of certified companies can be found on the website of the US Department of Commerce at dataprivacyframework.gov.

General Information on Data Storage and Deletion

We delete personal data that we process in accordance with the statutory provisions as soon as the underlying consents are revoked or no longer exist. This applies to cases in which the original purpose of processing ceases to apply or the data is no longer required.

The following general retention periods apply under German law:

  • 10 years – Books and records, annual financial statements, inventories, opening balance sheets and related working instructions (§ 147 para. 1 no. 1 AO, § 257 para. 1 no. 1 HGB)
  • 8 years – Accounting documents such as invoices and expense receipts (§ 147 para. 1 no. 4 AO, § 257 para. 1 no. 4 HGB)
  • 6 years – Other business documents, including received and sent commercial correspondence (§ 147 para. 1 no. 2, 3, 5 AO, § 257 para. 1 no. 2 and 3 HGB)
  • 3 years – Data required to take into account potential warranty and damages claims, based on previous business experience and standard industry practices (§§ 195, 199 BGB)

Rights of Data Subjects

As a data subject under the GDPR, you have the following rights:

  • Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6(1)(e) or (f) GDPR.
  • Right to withdraw consent: You have the right to withdraw your consent at any time.
  • Right of access: You have the right to obtain confirmation as to whether personal data concerning you is being processed, and to receive information about this data.
  • Right to rectification: You have the right to request the completion or correction of inaccurate personal data concerning you.
  • Right to erasure and restriction of processing: You have the right to request the immediate erasure of data concerning you, or alternatively to request restriction of processing.
  • Right to data portability: You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format.
  • Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.

Provision of the Online Offer and Web Hosting

We process users' data in order to provide our online services. For this purpose, we process the IP address of the user, which is necessary to transmit the content and functions of our online services to the user's browser or device.

  • Types of data processed: Usage data; meta, communication and procedural data; log data
  • Data subjects: Users
  • Purposes of processing: Provision of our online offer and user experience; IT infrastructure; security measures
  • Legal bases: Legitimate interests (Art. 6(1)(f) GDPR)

Collection of access data and log files: Access to our online offer is logged in the form of server log files. Log file information is stored for a maximum of 30 days and then deleted or anonymised. Data whose further retention is necessary for evidentiary purposes is exempt from deletion until the matter in question is finally resolved.

Use of Cookies

Cookies are functions that store and retrieve information on users' devices. They may be used for various purposes, including functionality, security, convenience and the analysis of visitor flows. We use cookies in accordance with the statutory provisions.

We use the consent management tool Borlabs Cookie to obtain and manage consents for the use of cookies and comparable technologies in a data protection-compliant manner. Users can change or withdraw their consent at any time via the cookie banner or cookie settings embedded on the website.

  • Types of data processed: Meta, communication and procedural data
  • Data subjects: Users
  • Legal bases: Legitimate interests (Art. 6(1)(f) GDPR); Consent (Art. 6(1)(a) GDPR)

Cookie storage periods:

  • Temporary cookies (session cookies): Deleted at the latest after a user leaves the online offer and closes their device.
  • Permanent cookies: Remain stored even after the device is closed. The storage period can be up to two years unless otherwise specified.

Blogs and Publication Media

We use a blog for online communication and publication. Readers' data is only processed to the extent necessary for the display of the content and for communication between authors and readers, or for security reasons.

  • Types of data processed: Inventory data; contact data; content data; usage data; meta, communication and procedural data
  • Data subjects: Users
  • Purposes of processing: Feedback; provision of our online offer; security measures; organisational and administrative procedures
  • Legal bases: Legitimate interests (Art. 6(1)(f) GDPR)

Comments and contributions: When users leave comments or other contributions, their IP addresses may be stored on the basis of our legitimate interests for security purposes. We also reserve the right to process users' details for spam detection purposes.

Contact and Inquiry Management

When contacting us (e.g. by post, contact form, email, telephone or via social media), the data of the enquiring persons is processed to the extent necessary to respond to the contact enquiries and any requested measures.

  • Types of data processed: Inventory data; contact data; content data; usage data; meta, communication and procedural data
  • Data subjects: Communication partners
  • Purposes of processing: Communication; organisational and administrative procedures; feedback; provision of our online offer
  • Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR); Legitimate interests (Art. 6(1)(f) GDPR)

Newsletter and Electronic Notifications

We send newsletters, emails and other electronic notifications only with the consent of the recipients or on a statutory basis. Where the contents of a newsletter are specifically described as part of the subscription process, those contents are determinative for the user's consent. Subscription to our newsletter generally only requires your email address.

  • Types of data processed: Inventory data; contact data; meta, communication and procedural data; usage data
  • Data subjects: Communication partners
  • Purposes of processing: Direct marketing
  • Legal bases: Consent (Art. 6(1)(a) GDPR)

Opt-out: You can unsubscribe from our newsletter at any time by using the unsubscribe link included in every newsletter or by contacting us via email.

Web Analytics, Monitoring and Optimisation

Web analytics is used to evaluate visitor flows to our online offer and may include behaviour, interests or demographic information about visitors as pseudonymous values. IP addresses are pseudonymised using an IP masking procedure.

  • Types of data processed: Usage data; meta, communication and procedural data
  • Data subjects: Users
  • Security measures: IP masking (pseudonymisation of IP address)
  • Legal bases: Consent (Art. 6(1)(a) GDPR); Legitimate interests (Art. 6(1)(f) GDPR)

Google Analytics

We use Google Analytics for the measurement and analysis of the use of our online offer on the basis of a pseudonymous user identification number. Google Analytics does not log or store individual IP addresses for EU users. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Affiliate Programmes and Affiliate Links

We include affiliate links and other references to third-party offers on our website. If users follow affiliate links and subsequently make use of those offers, we may receive a commission from those third parties.

To enable tracking of whether users have used an affiliate link placed on our website, it is necessary for the relevant third-party providers to be informed that the user followed an affiliate link within our online offer. The assignment of affiliate links serves solely for the purpose of commission settlement and is cancelled as soon as it is no longer required for that purpose.

Affiliate networks and partners used:

  • Travelpayouts – Affiliate network through which the following partners are integrated:
  • GetYourGuide – Tours, activities and shore excursions
  • Viator – Tours and excursions
  • Booking.com – Accommodation
  • Amazon Associates (Amazon Partner Programme) – Product recommendations

Affiliate disclosure: This website contains affiliate links. If you book or purchase through these links, we may earn a small commission at no extra cost to you. We only recommend services and products we genuinely believe in.

  • Types of data processed: Contract data; usage data; meta, communication and procedural data
  • Data subjects: Prospective customers; users
  • Purposes of processing: Affiliate tracking
  • Legal bases: Consent (Art. 6(1)(a) GDPR); Legitimate interests (Art. 6(1)(f) GDPR)

Presence on Social Networks (Social Media)

We maintain online presences on social networks and process users' data in this context in order to communicate with users who are active there, or to provide information about us. We note that user data may be processed outside the European Union in this context.

Instagram

Social network allowing the sharing of photos and videos, commenting on and favouriting posts, sending messages, and subscribing to profiles and pages. Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

Plug-ins and Embedded Functions and Content

We integrate functional and content elements into our online offer that are obtained from the servers of their respective providers (hereinafter referred to as "third-party providers"). These may include, for example, graphics, videos or maps. The integration always requires that the third-party providers process the IP addresses of users.

Google Fonts (loaded from Google server)

Fonts and symbols are loaded for technically secure, maintenance-free and efficient use. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Maps

We embed maps from the "Google Maps" service provided by Google. Data processed may include IP addresses and location data of users. Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland.

YouTube Videos

Video content embedded from YouTube. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

This privacy policy was created on the basis of the German privacy policy for kursaufsmeer.de and adapted for setcoursewithbibi.com.