Controller
The controller for this website, the customer account at testas-preparation.com/portal and the TestAS Trainer (page views, audience measurement, account and sign-in, learning progress, order, payment, extension, emails, contact) is:
PreMed GmbH, Universitätsstraße 5, 50937 Köln (Cologne), Germany, email: [email protected]
Legal bases
We process data where this is necessary to perform a contract or for pre-contractual measures (Art. 6 (1) point (b) GDPR), where we are legally obliged to, for example through retention duties (point (c)), or where we have a legitimate interest, for example in the secure operation of the pages and in evaluating their use (point (f)). If we store or read information on your device, this is done under § 25 TDDDG (German Telecommunications Digital Services Data Protection Act), where it is technically necessary to deliver the service you expressly requested (§ 25 (2) no. 2 TDDDG), and otherwise with your consent.
Visiting the website, hosting and Cloudflare
When you visit the pages, our hosting provider processes technically necessary data (server logs): IP address, date and time, requested address, amount of data transferred, browser and operating system. This is necessary to deliver the pages and to ensure the security of operation (Art. 6 (1) point (f) GDPR). The website, customer account and Trainer are hosted by Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4-6, 32339 Espelkamp, Germany; we have a data processing agreement with them (Art. 28 GDPR).
The domain is managed via Cloudflare (Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA). Where Cloudflare is placed in front as a proxy and protection against attacks, IP address and technical connection data are processed (Art. 6 (1) point (f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework; in addition, there are standard contractual clauses of the EU Commission and a data processing agreement.
The fonts of the website are on our own server. No connection to a font provider is made when you visit.
Google Analytics
On the website, in the customer account and in the Trainer, we use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to understand how the pages are used, for example which pages are visited and where visitors come from. Cookies are set and usage data such as pages visited, time spent, device, browser and approximate location are transmitted to Google; IP addresses are shortened by Google. A transfer to the USA is possible; Google is certified under the EU-US Data Privacy Framework. The legal basis is Art. 6 (1) point (f) GDPR. The data is deleted after 14 months. We do not measure pages that contain a one-time access link (for example for setting a password). You can prevent the collection with the browser add-on from Google or block cookies in your browser.
Customer account and sign-in
For purchase and Trainer you create an account. You can register with an email address and a password (we store the password only as a hash; for resetting it we send you an email) or sign in via Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) or via Apple (Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland). From there we receive your name and your email address. The legal basis is performance of the contract (Art. 6 (1) point (b) GDPR).
After you sign in, your browser stores a sign-in token so that you stay signed in. When you switch from the customer account to the Trainer, we pass on a short-lived sign-in key that can be used only once. Both are technically necessary (§ 25 (2) no. 2 TDDDG).
TestAS Trainer and learning progress
In the Trainer we store your answers, your simulations and their evaluation, as well as the duration of your access. This is necessary so that you can see results and progress and continue a simulation (Art. 6 (1) point (b) GDPR). The data remains as long as your account exists.
Order, payment and invoice
When you order, we process your name, your address, the product, the amount, a redeemed voucher code, the time and wording of your consents and the status of the order (Art. 6 (1) point (b) GDPR). For payment we forward you to Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (card payment), or to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. You enter your payment data there; we receive only a payment reference and the status of the payment. Because of tax and commercial law duties, we keep order, payment and invoice data for ten years (§ 147 AO, § 257 HGB; Art. 6 (1) point (c) GDPR). This also applies if you delete your account.
Extension request
If you request the free extension, we process the details in the request (university, degree programme, test date, comment) and the proof you upload, for example your TestAS certificate with your results or a notice from the university. We use them only to check the request (Art. 6 (1) point (b) GDPR). We delete the proof files 30 days after the decision, or immediately if you withdraw the request. The decision itself remains noted in your account.
Emails
We send you emails that belong to the contract: the confirmation of order and access with invoice, links to set or reset the password, reminders 30 and 7 days before your access ends and messages about an extension request (Art. 6 (1) point (b) GDPR). Sending and mailbox are run by netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany, as processor; we have a data processing agreement with them (Art. 28 GDPR).
Contact by email
If you write us an email, we process your address and your message in order to reply (Art. 6 (1) points (b) and (f) GDPR). We delete the data when the enquiry is dealt with and there is no retention duty.
Storage period
We store data only as long as is necessary for the respective purpose. Account data and learning progress remain as long as your account exists. Data from orders, payments and invoices we keep for ten years. Proof from extension requests we delete as described above. Server logs are stored only as long as secure operation requires.
Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). You can download a copy of your data in your account; there you can also request deletion of your account. Otherwise write to us at [email protected]. You also have the right to lodge a complaint with a data protection supervisory authority. An exclusively automated decision including profiling under Art. 22 GDPR does not take place; we check extension requests by hand.