Privacy policy

Controller

At a glance

• No cookies when you visit, no advertising tools. Anonymous visitor statistics with Plausible on our own server.
• No account and no sign-in for the exercises. Only buyers of the printable pack sign in with email and a code, and then get a sign-in cookie.
• Payment happens at Stripe. No Stripe script runs on this site.
• Fonts are served from our own server. Your browser does not contact Google or other font providers.
• Selection, filters and search in the exercises run only in your browser and are not sent to us.
• We do not collect any data about your child.

Hosting and server log files

When you open this site, your browser sends technical data to the server of our hosting provider. This happens with every website and is needed to deliver the pages. The following is processed: IP address, date and time of the request, the page requested, the referring page (referrer), browser and operating system, status code and amount of data transferred.

Purpose: delivering the site and keeping it secure, for example to detect attacks. Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is a secure and working website. We do not evaluate this data and do not combine it with other data.

The log files are stored by the hosting provider for as long as needed for secure operation and are then deleted, usually after a few days to a few weeks. The provider processes the data on our behalf (Art. 28 GDPR).

IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Deutschland. Provider's privacy notice

Audience measurement with Plausible

We count visits with Plausible Analytics, an open source software. It runs on our own server at our hosting provider. No data goes to Plausible Insights OÜ or any other third party.

Plausible sets no cookies, uses neither localStorage nor sessionStorage, no fingerprinting and does not recognize you across devices. An identifier is formed from the IP address and the browser identifier (user agent) with a random value (salt) that changes daily. The salt is deleted after 24 hours, IP address and user agent are not stored.

Only aggregated data is stored: page visited, referrer, country, region and city derived from the IP address, browser, operating system, device type and UTM parameters. On top of that, single click events: exercise opened, printing, steps in the purchase process, sign-in, download and withdrawal. These events contain no email address, no code and no order number.

Purpose: finding out which exercises are used and whether the purchase process works. Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest is anonymous usage statistics. Nothing is stored on or read from your device, so no consent under § 25 TDDDG is needed.

You can object at any time (Art. 21 GDPR): informally by email to us, or technically by blocking scripts in your browser.

Language setting in your browser

When you click a language button (DE, EN, ES), your choice is saved in your browser's local storage under the key "ngk-lang". Only the language code is stored. It is never sent to us and you can delete it at any time in your browser settings.

If you have not chosen a language, the home page reads the language setting of your browser or phone once and shows that language, or English if we do not offer it. Nothing is stored or sent to us in the process.

This storage only happens because you asked for it and is strictly necessary to remember your chosen language (§ 25 (2) no. 2 TDDDG). No personal data is stored.

Contact by email

If you write to us by email, we process your email address and your message to answer you. Legal basis: Art. 6 (1) (f) GDPR, or Art. 6 (1) (b) GDPR if your request relates to a contract. We delete the messages once your request has been dealt with, unless we are legally required to keep them. Please do not send us health information about your child by email.

Links to other websites

We link to sources, for example scientific articles. The linked website only receives data once you click a link. From then on, that provider's privacy policy applies.

In the footer we link to our profiles on YouTube, Instagram and Facebook. The icons are part of our own page, and we embed no content, scripts or buttons from these platforms. Only when you click a link does the platform open, and from then on its privacy policy applies.

Buying the Spielemappe

When you buy, we send you to the Stripe checkout (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Irland). Stripe processes your payment details as a separate controller, its privacy policy applies. Stripe sets its own cookies on the checkout page. We do not load any Stripe script on teselora.com. Stripe may also transfer data to Stripe, Inc. in the USA, according to Stripe on the basis of the EU-U.S. Data Privacy Framework and standard contractual clauses.

For each purchase, Stripe passes on to us: email address, name, for institutions the name of the institution, address and VAT ID, country, amount, time and the chosen license. We never receive card or account details.

We use this data to fulfil the contract (sending the access, providing the files, answering questions, handling withdrawals and refunds) and to meet tax and commercial record-keeping duties. Legal bases: Art. 6 (1) (b) and (c) GDPR. Purchase records are kept for the statutory retention periods, currently up to ten years.

We send the purchase confirmation, codes and confirmations of withdrawal by email via IONOS SE, which works on our behalf (Art. 28 GDPR). We do not send advertising to buyers.

Sign-in and download

To download, you sign in with the email address used for the purchase and a code we email to you. We only store a checksum of the code, it expires after a short time.

After signing in we set a cookie named "tg_session". It contains a random identifier, only applies to the path /api/paket/ and expires after 180 days or when you sign out. The cookie is strictly necessary for the download you asked for (§ 25 (2) no. 2 TDDDG).

Next to it we set a second cookie named "tg_access". It holds nothing but the note that someone is signed in, so the exercise pages can show you the content you bought. It applies to the whole site, lasts just as long and disappears when you sign out. This cookie is strictly necessary for the same service (§ 25 (2) no. 2 TDDDG).

For each sign-in we store the time, a rough device label (browser and operating system, for example “Firefox · Windows”) and when it was last used, and for each download the time and language. This lets us limit the number of devices and downloads and protects the access against being passed on. We do not store IP addresses for this. Legal bases: Art. 6 (1) (b) and (f) GDPR, our legitimate interest is protecting the files. Every page of the PDF shows your license number and email address.

Sign-ins are deleted when you sign out or when they expire, codes, sign-in and download records after 30 days at the latest. We keep your license with your email address as long as you should be able to download the pack. If you no longer want that, email us.

Withdrawal function

If you use the withdrawal function, we process your name, email address, license number if given and the time, to handle the withdrawal and to send you the confirmation of receipt. Legal basis: Art. 6 (1) (b) and (c) GDPR. We keep the data for the statutory retention periods.

Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6 (1) (f) (Art. 21). An email to us is enough.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin, Germany. You may equally contact the authority in the country or German state where you live. List of German supervisory authorities

You are not required to provide any data. There is no automated decision-making or profiling.

Changes

We update this policy when the site changes, for example if a new feature processes data. The current version is always available at /en/privacy/.