Privacy notice
This is a convenience translation. In the event of any discrepancy, the German version prevails.
Controller
Gemeinnützige Montessori Kronberg GmbH
Le-Lavandou-Straße 2
61476 Kronberg im Taunus
- Phone
- 06173-999 70-0
- Fax
- 06173 999-70-20
Data protection officer
Ulf Brossmann
An der Waldlust 1b
61440 Oberursel
General information
This privacy notice is intended to inform users of the website about the nature, scope and purpose of the collection and use of personal data by the website operator.
As the website operator we take data protection very seriously and treat your personal data confidentially and solely in accordance with statutory provisions. We recommend that you read our privacy notice at regular intervals, as it may change through the continuing development of our website or our services, or through legal or regulatory requirements.
In this privacy notice we use terms (such as “personal data” or “processing”) as defined in Article 4 of the GDPR.
Hosting
This website is hosted by Railway Corp., 548 Market St, San Francisco, CA 94104, USA. It is operated in a data centre in the Netherlands (region EU West). Railway processes the access data arising when the site is called up (see below) as a processor on our behalf; the basis for this is a data processing agreement under Article 28 GDPR. Insofar as data might be processed outside the EU, this takes place on the basis of the EU standard contractual clauses.
Access data
On the basis of our legitimate interest (see Article 6(1)(f) GDPR) we collect data about access to our website and store it in the server log files. The following data is logged:
- Page requested
- Referrer URL
- Date and time of the server request
- Status of the server request
- Volume of data transferred
- IP address
- User agent (browser & operating system)
These log files are stored for a maximum of 7 days and then deleted. The data is stored solely for security reasons, for example in order to investigate cases of misuse, and is not combined with other sources of data. Where data has to be retained as evidence, it is exempt from deletion until the incident has been conclusively resolved.
Cookies and local storage
This website sets no cookies. No third-party content is embedded and no external providers' tools are loaded. We store two items in your browser's local storage:
- Your decision about the measurement of visits — whether you agreed or declined. Without it we could not honour a refusal and would have to ask again on every page. This storage is therefore strictly necessary and takes place without consent under section 25(2)(2) TDDDG.
- Only after your consent: a randomly generated identifier for the measurement of visits (see the next section). If you decline or withdraw, it is deleted.
Measurement of visits
We would like to know which of our content is read and how visitors find us, in order to improve the site. This measurement only takes place if you have consented to it. The legal basis is your consent under Article 6(1)(a) GDPR in conjunction with section 25(1) TDDDG.
The following is recorded: the random identifier from local storage, the pages you open, the order in which you open them within a visit, the time spent on each page, the website you came from (without its query parameters — a search query contained there does not reach us), the language version and the time.
We do not record your name, your email address or any other details about you personally. Your IP address is not stored; it is used in memory only, to limit the number of reports per connection. The data is not combined with other sources, not passed on to third parties and not used for advertising.
The evaluation runs on the same server as this website, in a password-protected area accessible only to authorised members of the school. No third-party tool is involved; no data leaves our server.
The data collected is deleted automatically after twelve months. You may withdraw your consent at any time with effect for the future, using “Withdraw measurement consent” at the foot of every page. The identifier is deleted and nothing further is recorded. This does not affect the lawfulness of processing carried out up to that point.
Fonts and images
Fonts and images are delivered exclusively from our own web server. When the site is called up, no connection is made to servers operated by Google or any other provider; no third party therefore learns of the visit or of your IP address.
Collection and processing of personal data
In principle our website can be used without providing personal data. Should a user wish to use a function that requires personal data to be provided, the website operator processes that personal data only on an appropriate legal basis or with the consent of the data subject. Personal data means any information relating to an identified or identifiable natural person — for example your name, your email address or your telephone number.
Handling of contact data
If you contact us using the means offered (email, telephone), the details you provide are processed in order to handle and answer your enquiry (Article 6(1)(b) or (f) GDPR). This data is not passed on to third parties without your consent.
Contact form
You can send us an enquiry using the form on the admissions page. We process the details you enter yourself — name, email address and your message are required, telephone number and details about your child are voluntary — together with your IP address and the time of sending.
The purpose is to handle and answer your enquiry. The legal basis is your consent (Article 6(1)(a) GDPR), which you give before sending, and for admission enquiries also the taking of steps prior to entering into a contract (Article 6(1)(b) GDPR). You may withdraw your consent at any time with effect for the future — an informal email is enough. This does not affect the lawfulness of processing carried out up to that point.
Your details are not stored in a database. The service that receives the form holds them in memory only for as long as the transmission takes and passes them on immediately by email to our mailbox; it runs on the same hosting as the website (see the “Hosting” section). Your IP address is used solely to limit the number of submissions and to fend off automated bulk sending (legitimate interest, Article 6(1)(f) GDPR); it is not logged in the process and is discarded after 15 minutes at the latest.
An acknowledgement of receipt is sent automatically to the email address you provide. Sending and our mailbox run via Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) as a processor on the basis of an agreement under Article 28 GDPR. Your enquiry then remains in our mailbox for as long as it is needed in order to deal with it, and is deleted once the matter is closed and no statutory retention obligations stand in the way.
The form uses no CAPTCHA and loads no third-party content.
SSL encryption
This website is delivered exclusively in encrypted form over HTTPS. You can tell that an encrypted connection is active because the browser address bar begins with “https://” and shows a padlock symbol. Data you transmit to us over an encrypted connection cannot be read by third parties.
Your rights
As a user you have the right, on request, to receive free information about what personal data has been stored about you. You also have the right to have incorrect data rectified and to have the processing of your personal data restricted or your data erased. Where applicable, you may also exercise your right to data portability, insofar as this is technically possible and does not adversely affect the rights and freedoms of others. If you believe your data has been processed unlawfully, you may lodge a complaint with the competent supervisory authority — for Hesse this is the Hessian Commissioner for Data Protection and Freedom of Information.
Erasure of data
As a user you are entitled to have your data erased, unless this conflicts with a statutory obligation to retain data. Data we have stored is erased once it is no longer necessary for its purpose and no statutory retention periods apply. Where erasure is not possible because the data is required for permitted legal purposes, processing is restricted instead. In that case the data is blocked and no longer processed for other purposes.
Right to object
Users of this website may exercise their right to object and may object to the processing of their personal data at any time.
If you wish to have personal data stored about you rectified, blocked or erased, or to receive information about it, or if you have questions about the collection, processing or use of your personal data, or wish to withdraw consent you have given, please contact us using the contact details above.