Last updated: June 2026
This privacy policy explains how Syrische Gemeinde in Deutschland - "SGD" e.V., Haberstraße 1, 53121 Bonn, Germany (registered at Amtsgericht Bonn, VR 12726), as the data controller within the meaning of Art. 4(7) GDPR, collects, uses, and protects your personal data when you use the SGD Academy online learning platform.
Contact: [email protected] — subject line "Datenschutz / Data Protection"
The association has not designated a Data Protection Officer, as this is not required for our processing activities (Art. 37 GDPR, § 38(1) BDSG).
1. What Data We Collect and Why
We collect only data necessary to operate the learning platform. Providing your name and email address is required to create an account; without this data we cannot grant you access to the platform. Providing your full name in both languages, year of birth, country, city, and phone number at enrollment is required to issue a certificate; without it no certificate can be issued.
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Name and email address | Create and manage your account; send course notifications | Art. 6(1)(b) — contract performance |
| Password | Authenticate your login | Art. 6(1)(b) — contract performance |
| Social login data (name, email, and profile photo from Google — only if you choose Sign in with Google) | Authenticate your login without a password | Art. 6(1)(a) — your consent when you choose to sign in via Google. You may revoke this at any time via your Google account settings; your Academy account will then revert to password-based login. |
| Full name in Arabic and English, year of birth, country, city, phone number — collected at course enrollment | Verify your identity for course records; issue certificates in your correct name in both languages | Art. 6(1)(b) — contract performance |
| Lesson progress and video watch time | Track your course completion and determine certificate eligibility | Art. 6(1)(b) — contract performance |
| Quiz answers and scores | Assess learning outcomes | Art. 6(1)(b) — contract performance |
| Course reviews, ratings, and lesson comments | Display peer feedback and improve course quality | Art. 6(1)(f) — legitimate interest in enabling community feedback and improving course offerings |
| Certificate data (name in Arabic and English, course title, training hours, issue date, verification code) | Issue and permanently verify your certificate of attendance | Art. 6(1)(b) — contract performance; Art. 6(1)(f) — legitimate interest in maintaining the integrity and long-term verifiability of issued credentials |
| Support ticket content | Respond to your support requests | Art. 6(1)(b) — contract performance |
| IP address, browser type, session data, login history | Security, fraud prevention, and abuse detection | Art. 6(1)(f) — legitimate interest in maintaining platform security and preventing unauthorized access |
| Anonymous usage statistics | Understand how the platform is used to improve it | Art. 6(1)(f) — legitimate interest in improving platform functionality based on aggregate usage data |
We do not collect payment card numbers, location data, or any data unrelated to learning and account management. We do not share your personal data with third parties for commercial purposes.
2. Certificate Verification
When a certificate is issued to you, it is assigned a unique verification code. Anyone who holds that code can look up your name, course title, and training hours on our certificate verification page. This allows employers and institutions to confirm the authenticity of your credential.
This disclosure is based on our legitimate interest in maintaining the integrity and value of issued credentials (Art. 6(1)(f) GDPR). You have the right to object to this processing at any time by contacting us at [email protected]. Upon a valid objection we will remove your certificate data from the public verification page while retaining it in our internal records to prevent fraudulent re-issuance.
3. How Long We Keep Your Data
- Account data (name, email, profile photo): retained until you request account deletion.
- Enrollment and learning activity: retained while your account is active and deleted alongside your account upon a valid erasure request.
- Certificates: retained for as long as the credential may reasonably be relied upon for verification purposes. We review retention of credential data periodically.
- Support tickets: retained for up to 3 years after resolution, in accordance with applicable limitation periods (§ 195 BGB).
- Server and access logs: retained for a maximum of 30 days for security purposes.
4. Who We Share Data With
We do not share your personal data with third parties for commercial purposes. We share data only with the following service providers under data processing agreements (Art. 28 GDPR):
| Provider | Purpose | Location |
|---|---|---|
| netcup GmbH | Server hosting — all platform data is stored on their infrastructure | 🇩🇪 Germany |
| Cloudflare, Inc. | Network delivery and security | EU / USA (Standard Contractual Clauses) |
Third-party services — the following services are integrated into the platform and act as independent data controllers. Your interactions with them are governed by their own privacy policies:
- Google LLC — used for anonymous usage statistics, font delivery (the Almarai typeface loaded on every page sends your IP address to Google's servers), the course schedule displayed on the homepage (Google Calendar), and optional account login ("Sign in with Google"). Subject to the EU–US Data Privacy Framework and Standard Contractual Clauses. See Google Privacy Policy.
5. Your Rights Under GDPR
Under the GDPR and the German Federal Data Protection Act (BDSG), you have the following rights:
- Access — request a copy of the personal data we hold about you
- Rectification — correct inaccurate data (name, email, and profile can be updated directly in your account settings)
- Erasure — request deletion of your account and associated data (note: certificate records may be retained to preserve credential integrity, subject to your right to object under Art. 21 GDPR)
- Restriction — ask us to limit processing while a dispute is being resolved
- Portability — receive your data in a machine-readable format (applies to data processed by automated means on the basis of consent or contract)
- Objection — object to processing based on our legitimate interests (Art. 6(1)(f)), including the public verifiability of your certificate
- Withdraw consent — if you signed in via Google, you may revoke the SGD Academy's access at any time via your Google account security settings (myaccount.google.com/permissions). Withdrawal of consent does not affect the lawfulness of processing that took place before the withdrawal.
We do not make decisions about you based solely on automated processing — including profiling — that would have a legal or similarly significant effect on you (Art. 22 GDPR). Certificate eligibility is calculated automatically from your completion data but does not constitute a solely automated decision within the meaning of Art. 22.
To exercise any of these rights, email [email protected] with the subject line "Datenschutz / Data Protection". We will respond within one month. For complex or numerous requests, we may extend this by up to two additional months and will inform you of any extension.
You also have the right to lodge a complaint with the data protection supervisory authority for North Rhine-Westphalia (LDI NRW): www.ldi.nrw.de
6. Children
The SGD Academy is intended for participants aged 16 and over. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has registered, please contact us at [email protected] and we will delete the account promptly.
7. Changes to This Policy
We may update this policy when the platform changes. We will notify registered users of significant changes via the platform. The date at the top of this page always reflects the current version.