Privacy Policy

Controller

The controller for the processing described here within the meaning of the GDPR is: Enuncy UG (haftungsbeschränkt) Feldstrasse 6 46535 Dinslaken Germany

Account data

To create and operate your account we store your e-mail address, a cryptographic hash of your password (never the password itself), whether your address has been confirmed, and the security settings you enable, such as two-factor authentication. Legal basis is Art. 6 (1) (b) GDPR: without this data we cannot provide you with an account.

Signing in with Google

You can sign in with a Google account instead of a password. If you do, Google tells us your e-mail address and a Google user identifier, and Google learns that you signed in to Enuncy. We never receive your Google password. This only happens once you actively choose the Google button, and the legal basis is Art. 6 (1) (b) GDPR. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which may transfer data to Google LLC in the United States. If you prefer not to involve Google, register with an e-mail address and password instead.

Consent records

When you accept the Terms of Service and this Privacy Policy, we store which document you accepted, the version number, and the time of acceptance. We are required to be able to demonstrate consent, so the legal basis is Art. 6 (1) (c) GDPR in conjunction with Art. 7 (1) GDPR.

Subscriptions, payments and invoices

If you take out a paid subscription we store your billing address, the plan and billing interval you chose, every payment attempt with its amount, status and date, and the invoices generated from them. Legal basis is Art. 6 (1) (b) GDPR for the contract itself and Art. 6 (1) (c) GDPR for the parts we are required to keep for tax and commercial law purposes.

Payments are handled by Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands. You are redirected to Mollie to enter your payment details, which means card numbers and bank details are entered on Mollie systems and never reach us. We only receive a payment identifier, the status, the amount, and a masked reference such as the last four digits, so that we can show you which method is on file. Mollie processes this data as an independent controller under its own privacy policy as well as on our behalf.

Learning progress

We record which lessons and exercises you have worked through, so that the app can show you where you left off and unlock the content your plan includes. This data is tied to your account, is not used to profile you, and is not passed on to anyone. Legal basis is Art. 6 (1) (b) GDPR.

Server log data

Our server records the usual technical data for each request: IP address, date and time, the resource requested, the response status, the referring page and your browser identification. We need this to deliver the site, to investigate faults and to defend against attacks. Legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is a working and secure service.

Cookies and local storage

We only use cookies and browser storage that the service needs to function: a session cookie that keeps you signed in, a token that protects forms against cross-site request forgery, and local storage for settings such as your chosen theme. There is no advertising, no analytics, no tracking pixel and no third-party statistics tool on this site. Because these entries are strictly necessary to provide the service you requested, they do not require consent under section 25 (2) TDDDG. You can delete them at any time in your browser settings, but you will then be signed out.

Fonts and external content

The typeface used on this site is delivered from our own server. No fonts, scripts or other resources are loaded from third-party servers, so your IP address is not passed to any content delivery network when you open a page.

Processors

We use the following service providers, each under a data processing agreement pursuant to Art. 28 GDPR:

Hosting is provided by UltaHost, Inc., 651 N Broad St, Suite 206, Middletown, Delaware 19709, United States. The server that runs Enuncy is located in Chicago, United States.

Payment processing is provided by Mollie B.V., Amsterdam, Netherlands.

E-mail delivery for confirmation, cancellation and invoice messages is provided by [E-MAIL PROVIDER].

Transfers outside the EU

Our hosting provider is incorporated in the United States and the server that runs Enuncy stands in Chicago. All the data described in this policy, including your account, your learning progress, your billing address and the server logs, is therefore stored in the United States. The transfer is safeguarded by the Standard Contractual Clauses adopted by the European Commission under Art. 46 (2) (c) GDPR. The same applies where Google transfers sign-in data to the United States. United States law does not offer a level of data protection equivalent to that of the European Union: public authorities there may be granted access rights that go beyond what European law permits, and you have no equivalent judicial remedy against them.

How long we keep your data

Account data, learning progress and billing addresses are kept for as long as your account exists and are deleted when you delete it. Invoices and the payment records behind them must be retained for ten years under section 147 of the German Fiscal Code and section 257 of the German Commercial Code, and therefore remain on file after your account is gone. Consent records are kept for as long as the underlying contractual relationship exists and afterwards for the duration of the statutory limitation period, because they are our proof that consent was given. Server logs are deleted after a short period unless a specific incident requires us to keep them longer.

Deleting your account

You can delete your account yourself under Account, Personal data. If a paid subscription is still running you have to cancel it first. Deletion is confirmed by e-mail and, once you follow that link, your account and the personal data tied to it are removed and all your sessions are ended. The invoices and payment records described above are the exception and stay on file for the statutory retention period.

No automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. Nothing on this site decides anything about you without a person being involved.

Your rights

You have the right to obtain information about the data we hold on you (Art. 15 GDPR), to have inaccurate data corrected (Art. 16 GDPR), to have data erased (Art. 17 GDPR), to have processing restricted (Art. 18 GDPR), and to receive your data in a portable format (Art. 20 GDPR). You may object at any time to processing based on our legitimate interest (Art. 21 GDPR). Where processing rests on your consent, you may withdraw it at any time with effect for the future, which does not affect what was lawful before.

To exercise any of these rights, write to Contact@Enuncy.com. You can also export or delete your data yourself under Account, Personal data.

Right to complain

If you believe we are handling your data unlawfully, you can complain to a supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2-4, 40213 Düsseldorf, Germany. You may also turn to the supervisory authority where you live.

Changes to this policy

We update this policy when the service changes or the legal situation requires it. If a change is material, we will ask you to accept the new version the next time you sign in. The version and date at the top of this page always tell you which text is currently in force.