Privacy policy

1. Controller

The controller for data processing on this website within the meaning of Art. 4 (7) GDPR is:

Cyan Group L.L.C-FZ
Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba
Meydan Free Zone, Dubai
United Arab Emirates
Email: info@approuva.com

2. Data protection contact

For any question about data protection you can reach us at the contact details above.

3. Hosting and server log files

This website is hosted by an external provider. The servers are located in a data centre in Germany. The provider is Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus.

When a page is requested, the server automatically collects data your browser transmits and stores it in log files: the address requested, the date and time of access, the volume of data transferred, a message on successful retrieval, browser type and version, operating system, the page visited before, and the IP address.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in technically error-free operation, the security of our systems and the prevention of attacks. This data is not merged with other sources.

We can view these access logs in the host’s customer area for the last seven days only. How long the host keeps them is governed by its privacy policy: hostinger.com/legal/privacy-policy.

When a page that does not exist is requested, our SEO plugin (Rank Math) stores the requested address, the time, the referring page and the browser identifier so that we can find and fix broken links. IP addresses are not stored. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is an error-free website.

A data processing agreement under Art. 28 GDPR is in place with the hosting provider.

4. Contact form

If you write to us using the contact form, we process the data you enter: name, email address, optionally a telephone or WhatsApp number, the subject you select and your message. The form system additionally stores the time of submission and the IP address it was sent from.

The purpose is to handle your enquiry. The legal basis is Art. 6 (1) (b) GDPR where your enquiry is aimed at entering into a contract, and otherwise Art. 6 (1) (f) GDPR based on our legitimate interest in answering enquiries.

The details are stored in this website’s database and additionally sent as a notification to our internal email address.

We delete the data once your enquiry has been dealt with conclusively and no statutory retention obligations apply.

5. Registration for the Live KP course

If you register for the Live KP course through the registration form, we process: name, email address, optionally a telephone or WhatsApp number, your current country, the stage of preparation you state, your planned time frame, your preferred language and an optional message. The time of registration and the IP address are also stored.

The sole purpose is to inform you about the start and the conditions of the KP programme. The legal basis is your consent under Art. 6 (1) (a) GDPR, which you give expressly in the form.

Registration uses a double opt-in: after you submit the form you receive an email with a confirmation link. Only after you click it is your registration confirmed and you receive information about the course; without confirmation we send you no further emails. Your details are stored in this website’s form entries and in the contact management tool FluentCRM, which also runs on our own WordPress system at Hostinger; no further service provider is involved. The APPROUVA team is notified of each new registration by email (see section 9).

Registering through the form is without obligation and creates no payment obligation; a contract for course participation is concluded separately.

You may withdraw your consent at any time with effect for the future. An informal message to the email address above is sufficient. The lawfulness of processing carried out before the withdrawal remains unaffected. After withdrawal we delete your details unless statutory retention obligations apply.

Please do not send health data or any information about patients through these forms. The forms are not intended for such data.

6. Cookies and local storage

For visitors this website sets a single, strictly necessary cookie: pll_language stores your language choice (German, English or Arabic) for one year. Only for logged-in editors does WordPress also set session cookies.

The legal basis is § 25 (2) no. 2 TDDDG, because this storage is strictly necessary for the website to work. No consent is required for it.

We currently use no cookies for analytics, advertising or tracking.

7. Fonts

The fonts used on this website, Plus Jakarta Sans and IBM Plex Sans Arabic, are served locally from our own server. No connection is made to Google servers or to any other provider, and no data is transmitted to third parties.

8. Analytics and marketing services

For simple audience measurement we use Koko Analytics. It runs entirely on our own server; it sets no cookies, stores no IP addresses, builds no user profiles and passes no data to third parties. Only aggregated figures are recorded: how often each page was viewed and which website visitors came from. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is to understand and improve the use of our offer.

Beyond that we use no tracking or advertising services. In particular there is no Google Analytics, no Meta pixel and no third-party chat or advertising script embedded.

Should such services be introduced, we will update this policy and, where required, obtain your consent in advance through the consent banner.

Ordering and payment

When you book the Live KP course we process your name, e-mail address, the chosen price option, order and payment status, your acceptance of the terms and, if you choose it, your request for an early start. Legal basis: Art. 6 (1) (b) GDPR (contract) and, for retention duties, Art. 6 (1) (c) GDPR.

For order handling, invoices, instalments and order e-mails we use SureCart (SureCart Inc., 2055 Limestone Rd, STE 200-C, Wilmington, Delaware 19808, USA) as processor. SureCart is certified under the EU-U.S. Data Privacy Framework.

SureCart does not pass card details to us; payments are processed by the payment providers Stripe or PayPal (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland; PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg).

Running the course via Zoom

Live sessions take place on Zoom (Zoom Communications, Inc., 55 Almaden Blvd, Suite 600, San Jose, CA 95113, USA). This involves in particular your display name, e-mail address, video and audio (if you switch on camera or microphone), chat messages and technical connection data. Zoom is certified under the EU-U.S. Data Privacy Framework. Legal basis: Art. 6 (1) (b) GDPR.

Sessions are recorded and made available to participants. If you switch on your camera or microphone, you may be visible or audible in the recordings; you can leave both off and ask questions in the chat. Recordings are made available only to the participants of the course and deleted once they are no longer needed for the course (Art. 6(1)(b) GDPR).

Withdrawal via the website

If you use the „Vertrag widerrufen“ function we process your name, contract details, e-mail address and optional message to handle the withdrawal and acknowledge receipt (Art. 6 (1) (c) GDPR). The details are stored in this website’s database.

9. Recipients and processors

Your data is passed on to third parties only where this is necessary to provide our services, where you have consented, or where we are legally obliged to do so.

Our processor is our hosting provider Hostinger (address in section 3), which also runs the website and the sending of e-mail. An agreement under Art. 28 GDPR is in place with it.

Notifications about new messages and registrations are delivered by e-mail to the APPROUVA team’s mailboxes, which are hosted by Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).

10. Transfers to third countries

With Google’s e-mail service a transfer of personal data to the USA cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework; the transfer relies on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR). For booking, payment and running the course we also transfer data to the service providers in the USA named in the sections «Ordering and payment» and «Running the course via Zoom».

11. Retention

We process personal data only for as long as is necessary for the respective purpose. It is then deleted unless commercial or tax retention periods apply.

12. Your rights

You have the right at any time to information about the data stored about you (Art. 15 GDPR), to rectification of inaccurate data (Art. 16 GDPR), to erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR) and to data portability (Art. 20 GDPR).

You also have the right to object, on grounds relating to your particular situation, to processing based on Art. 6 (1) (f) GDPR (Art. 21 GDPR).

A message to the address given under section 1 is sufficient to exercise these rights.

13. Right to lodge a complaint

Without prejudice to any other remedy, you have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence, place of work or of the alleged infringement.

14. Encryption

This website uses TLS encryption. You can recognise an encrypted connection by the address bar beginning with https:// and by the padlock symbol in your browser. While encryption is active, the data you send us cannot be read by third parties.

15. Changes to this policy

We update this privacy policy whenever the data processing on this website changes, for example through new features or new services. The version published on this page applies.