Privacy policy

1. Controller and contact

The controller for this website and for processing enquiries and our own customer contracts is:

2. Website and server operation

When you visit the website, technically necessary connection data is processed. This may include your IP address, date and time, the requested address, response status, browser and operating system, and the previously visited page where your browser transmits it. This data is used to deliver the website, analyse errors and prevent misuse.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is secure and reliable operation. Server logs are deleted within seven days; in the event of a specific security incident, necessary data may be retained until the incident is resolved and, where appropriate, for the assertion of legal claims.

The server and email infrastructure is operated by STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. Where the provider processes personal data on our behalf, this is governed by a data processing agreement under Article 28 GDPR.

3. Contact form and email

When you contact us, the contact details you provide and the content of your enquiry are processed to respond to your request. The contact form asks for your first and last name, email address, subject and message; company and phone number are optional. The message is emailed to yasa-it through our own server infrastructure. For enquiries about a possible or existing contract, the legal basis is Article 6(1)(b) GDPR. Other enquiries are handled on the basis of our legitimate interest in responding under Article 6(1)(f) GDPR.

The information is deleted once the enquiry has been resolved and there are no statutory retention duties or legitimate grounds for further storage. Contacting us does not automatically add you to a marketing mailing list.

4. Registration for YasaEdu

Registration collects the name of your school or institution, your first and last name, email address, phone number, how you heard about us and confirmation of the terms of use. The school abbreviation and website are optional.

Registration data is first checked by this website’s form service and then sent to the YasaEdu application. It is used to process registration, confirm your email, set up and manage access, and communicate about use. Necessary contract and access data is processed under Article 6(1)(b) GDPR.

The information about how you found us helps us understand demand and improve customer outreach. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is evaluating our own sales channels. You may object to this processing on grounds relating to your particular situation.

The registration form cannot currently be submitted without the details marked with an asterisk. Optional information is not a condition for entering into the contract. Accepting the terms of use is not blanket consent to advertising or additional data processing.

If you expressly agree during registration, we will occasionally send you product news and offers about YasaEdu by email (Art. 6(1)(a) GDPR). Consent is voluntary and not a condition for concluding the contract. You can withdraw it at any time with effect for the future, using the unsubscribe link in each of these emails or in the YasaEdu settings; the lawfulness of processing carried out until then is not affected. As proof, we store your choice and the time.

5. Customer account, contract and billing

For our own YasaEdu contract, we process contact, company, contract and billing data, in particular addresses, booked services, fees, invoices and payment status. This is done to perform the contract under Article 6(1)(b) GDPR and fulfil legal obligations under Article 6(1)(c) GDPR.

Contract data is stored for the duration of the contract and afterwards only as long as required for statutory retention duties or the assertion or defence of legal claims. Different retention periods may apply to individual documents. Ending access does not automatically delete all billing records.

6. Educational institutions’ data

The respective institution is generally the controller for pupil, parent, teacher, lesson and contract data it manages in YasaEdu. yasa-it processes this data on the institution’s behalf and according to its documented instructions under a data processing agreement.

For access, rectification or erasure requests relating to this data, please contact your institution first. yasa-it assists it in handling these requests. Our own customer relationship with an institution is instead subject to the controller responsibilities described in this policy.

The return and deletion of data processed on behalf of an institution follow the data processing agreement and documented instructions. Records yasa-it must retain to meet its own legal obligations remain separate.

7. Cookies and browser preferences

This website stores your selected appearance locally in your browser: yasa-v4-mode for light/dark mode and, where applicable, yasa-v4-design for the design variant. These values restore your selected appearance and are not sent to the server as registration data. Without a stored preference, brightness may follow your system setting.

You can remove these preferences by clearing the website’s data in your browser. Otherwise, they remain until changed or deleted. Storage provides the display function you expressly selected (section 25(2)(2) TDDDG); where personal data is processed, the legal basis is Article 6(1)(f) GDPR to provide this function.

Under yasa-cookie-notice we also store acknowledgement of the cookies and local storage notice, with a version number and an expiry date six months later. This acknowledgement is not consent to analytics or advertising. ‘Cookie settings’ in the footer reopens the notice. Storage hides the acknowledged notice during this period (section 25(2)(2) TDDDG).

This landing page does not use marketing or analytics cookies. Login and access protection in the YasaEdu application are separate from these display preferences.

8. Recipients and additional services

Personal data is accessible only to parties that need it for the relevant purpose, in particular the operator and appointed infrastructure providers. Data is disclosed to authorities where legally required.

The landing page does not send form submissions to an AI service or process card payments through an embedded payment form. If additional payment or AI services are provided in YasaEdu, the specific providers, data flows and any transfers to third countries must be explained in the relevant privacy information before use.

9. Form protection

To prevent automated and abusive requests, we operate our own security check (ALTCHA): while you complete the form, your browser solves a short computational task and our server checks the result. No cookies are set, no usage behaviour is analysed and no data is sent to third parties for this. We also use a field not intended for humans to fill in, a minimum completion time and request limits. No external CAPTCHA provider is integrated.

The form service processes your IP address (grouped to the /64 network for IPv6), request origin, form type and, on submission, email address. Only pseudonymised check values (hashes created with a secret key) are stored, not plain-text addresses. Challenges expire after ten minutes; request limits use windows of at most one hour. Expired entries are regularly deleted.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is protecting the website, email delivery and registration from spam and overload. Server logs are handled separately according to the criteria described above.

10. Your rights

Subject to the legal requirements, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). You may withdraw consent at any time with future effect; processing carried out before withdrawal remains lawful.

Right to object: Where processing is based on Article 6(1)(f) GDPR, you may object under Article 21 GDPR on grounds relating to your particular situation. You may object to processing for direct marketing at any time.

Please address requests about data for which yasa-it is responsible to support@yasa-it.de. You may also lodge a complaint with a data protection supervisory authority under Article 77 GDPR, particularly where you live or work or where you believe the infringement occurred. In North Rhine-Westphalia this is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.

11. Security and updates

Technical and organisational measures protect personal data, in particular encrypted transmission in production and task-based access rights. This policy is updated when the services actually used or the processing activities change.