1. Controller
The controller responsible for the Road2Germany / R2G platform is Düsseldorf Consulting GmbH.
Königsallee 22
40212 Düsseldorf
Deutschland
Email: contact@road2germany.de
Phone:
Managing Director: Bülent Cakiroglu
2. Applicable data protection law
Our processing of personal data is governed primarily by the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and, where applicable, the German Telecommunications-Digital-Services Data Protection Act (TDDDG).
As the platform is operated by a company established in Germany, our data protection practices are governed by German and European Union data protection law.
3. Personal data we process
Account data: first name, last name, email address, optional phone number and an irreversible hash of your password.
Assessment data: answers submitted through the eligibility test, the resulting score and category or area-based results.
Exam data: your Life in Germany test sessions, submitted answers and results.
Document data: documents you voluntarily upload through document features, such as diplomas, passports or certificates.
Transaction and billing data: purchased services or packages, order number, payment method and required billing information.
Technical data: session information, language preference, IP-related technical information and server access logs required for security.
Communication data: information and messages submitted through contact, advertising or partnership forms.
4. Purposes and legal bases
We process data required to create your account, perform the eligibility test, retain your results and provide purchased services under Art. 6(1)(b) GDPR, performance of a contract or steps prior to entering into a contract.
Data required to comply with tax, accounting, invoicing and other statutory obligations is processed under Art. 6(1)(c) GDPR.
We process data required to secure the platform, prevent fraud and misuse, diagnose technical issues and safely improve the service on the basis of our legitimate interests under Art. 6(1)(f) GDPR.
When you contact us regarding a service, partnership or other enquiry, the necessary information may be processed under Art. 6(1)(b) or Art. 6(1)(f) GDPR depending on the nature of your request.
Where an optional activity specifically requires consent, processing is based on Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future.
5. Country detection and IP addresses
Your IP address may be used to determine your country where services or prices are displayed according to country.
Where this lookup is performed against a database stored locally on our own infrastructure, your IP address is not sent to a third party for this purpose and the resulting country information is not permanently stored.
IP addresses may also appear temporarily in server logs for security, error diagnosis and abuse prevention.
6. Cookies and browser storage
The platform may store information such as a session identifier and language preference in your browser where this is technically necessary to provide the service.
Storage or access that is strictly necessary to provide a digital service explicitly requested by the user may be carried out without separate consent under § 25(2) TDDDG.
Non-essential analytics, advertising or tracking technologies, if introduced, will only be activated after the required information has been provided and consent obtained where legally required.
7. Service providers and recipients
We do not sell personal data.
Personal data is shared only where necessary with providers supporting hosting, email delivery, payments, security and technical operation of the platform.
Services such as Resend may be used to deliver password reset, account or service-related emails.
Where Stripe and/or PayPal payment options are enabled, information required to process the payment may be processed by the relevant payment provider under its own privacy terms. Where card details are processed directly by the payment provider, Road2Germany does not store your full card number.
Service providers processing personal data on our behalf are, where applicable, bound by data processing arrangements in accordance with Art. 28 GDPR.
8. Transfers outside the EEA
Some technical service providers may be established outside the European Union or European Economic Area or may process data in those countries.
Where such a transfer occurs, it is carried out in accordance with Art. 44 et seq. GDPR using an applicable transfer mechanism, such as an adequacy decision by the European Commission or appropriate safeguards such as Standard Contractual Clauses where required.
9. Retention
Personal data is retained only for as long as necessary for the relevant purpose or for as long as statutory retention obligations apply.
Account information is generally kept while your account remains active. Following account deletion, it is removed or anonymised from operational systems within 30 days unless a statutory retention obligation requires continued storage.
Eligibility answers and results may be retained while linked to your account and are deleted or irreversibly disassociated from your identity when the account is deleted.
Documents uploaded by you are removed when you delete them and, unless a legal obligation applies, within 30 days after account closure.
Server access logs used for security are normally retained for no longer than 30 days.
Accounting and tax records are retained for the periods required by German law. Accounting vouchers may generally be subject to an eight-year retention period, while certain accounting books, annual financial statements and other records may be subject to ten-year periods.
Where statutory retention duties apply, the relevant information cannot be deleted before expiry of the applicable period but its use for unrelated purposes is restricted.
10. Requirement to provide data
Information marked as required when creating an account or purchasing a service is necessary to enter into the relevant contract or provide that service.
You are not required to provide information marked as optional. For example, where a phone number is optional, leaving it blank will not prevent account creation.
11. Your rights
You have a right of access under Art. 15 GDPR and a right to rectification under Art. 16 GDPR.
Where the applicable requirements are met, you may request erasure under Art. 17 GDPR or restriction of processing under Art. 18 GDPR.
Where Art. 20 GDPR applies, you may have the right to receive your personal data in a structured, commonly used and machine-readable format.
Under Art. 21 GDPR you may object to certain processing based on legitimate interests.
Where processing is based on consent, you may withdraw that consent at any time with effect for the future.
To exercise your rights, contact us at contact@road2germany.de.
12. Right to lodge a complaint
Under Art. 77 GDPR you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes data protection law.
As our company is established in Düsseldorf, Nordrhein-Westfalen, one relevant supervisory authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).
LDI NRW · Kavalleriestraße 2–4 · 40213 Düsseldorf · Germany
Email: poststelle@ldi.nrw.de
13. Updates to this notice
We may update this notice if platform functionality, service providers or legal requirements change.
The current version will be made available on the platform.
