This translation is for information only. Only the German version is legally binding.
Here you can find out which personal data we process when you visit our website, learn with us or travel with us – and which rights you have.
1. Controller
ArabVista UG (haftungsbeschränkt)
Mainzer Straße 25, 10247 Berlin, Germany
Represented by: Aiman Eryani (Managing Director)
Email: info@arabvista.net
We are not required to appoint a data protection officer. If you have any questions about data protection, simply write to us at info@arabvista.net.
2. Hosting and server log files
Our website is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The servers are located in Germany. We have concluded a data processing agreement with ALL-INKL in accordance with Art. 28 GDPR.
When you visit our website, the server automatically stores the following data in so-called log files:
- IP address of your device
- Date and time of access
- Page or file accessed
- Website you came from (referrer)
- Browser and operating system used
We need this data so that the website works, runs stably and is secure. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest). The log files are automatically deleted after a short time. We do not draw any conclusions about you from them.
3. Encryption
Our website uses SSL/TLS encryption. You can recognise it by “https://” and the padlock symbol in your browser. This means data you send to us cannot be read by third parties.
4. Cookies
We only use cookies that are technically necessary – for example so that you stay logged in to your account, for the booking process or to protect against attacks. We do not need consent for this (Section 25 (2) TDDDG, Art. 6 (1) (b) and (f) GDPR).
We only set analytics or advertising cookies if you agree to this beforehand in our cookie banner (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). You can withdraw your consent at any time.
5. Fonts
The fonts on our website are stored locally on our server. No connection is made to Google or other font providers when the site is accessed.
6. Security and spam protection
To protect against attacks we use the security plugin Wordfence by Defiant Inc., 1700 Westlake Ave N Ste 200, Seattle, WA 98109, USA. Wordfence checks access to our website and processes your IP address and technical data about your access. Data may be transferred to the USA in the process. The legal basis is our legitimate interest in a secure website (Art. 6 (1) (f) GDPR).
To prevent spam in forms we use the plugin Antispam Bee. It runs on our server and does not pass any data on to third parties.
We also protect the login and registration forms with Google reCAPTCHA (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When these forms are opened, reCAPTCHA uses technical characteristics (e.g. IP address, browser, behaviour on the page) to check whether the input is made by a human or an automated program. Data may be transferred to Google in the USA; Google is certified under the EU-US Data Privacy Framework. The legal basis is our legitimate interest in protecting accounts from misuse (Art. 6 (1) (f) GDPR).
7. Contact, chat and forms
If you write to us by email, via a form or via the chat on our website, we process your details (e.g. name, email address, your message) in order to answer your enquiry. The legal basis is Art. 6 (1) (b) GDPR if it concerns a contract or booking, otherwise Art. 6 (1) (f) GDPR.
For email, calendar and documents we use Google Workspace by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We have a data processing agreement with Google. A transfer to the USA is possible; Google is certified under the EU-US Data Privacy Framework.
AI assistant: On our website you can ask an AI assistant questions about our services. For this purpose your questions and the answers are transmitted to and processed by Anthropic Ireland, Limited (provider of the AI model “Claude”); this may involve a transfer to the USA, which is safeguarded by the EU Standard Contractual Clauses. We have a data processing agreement with Anthropic, and Anthropic does not use the content to train its models. We store questions and answers without names and without IP addresses for 30 days in order to improve the assistant and prevent misuse; to limit the number of questions we use a daily changing, untraceable code. If you would like someone from our team to get in touch with you, the assistant asks for your email address or phone number, your concern and – for a call-back – a suitable time. We forward this information to our team by email, use it only to reply to you and delete it after 90 days at the latest (Art. 6 (1) (b) GDPR). For an email enquiry we send you a short confirmation of receipt. If you would like to write directly with someone from the team, we forward your concern and your messages in the live chat via the messenger service Telegram (Telegram Messenger Inc.) to our team’s phone; the replies come back to the chat the same way. In the process, the content is also processed outside the EU. We have short replies from our team linguistically polished by the AI assistant before they are displayed. The legal basis is our legitimate interest in a fast personal reply (Art. 6 (1) (f) GDPR); you use the live chat voluntarily. Please do not enter any sensitive data in the chat. The legal basis is our legitimate interest in answering questions quickly and around the clock (Art. 6 (1) (f) GDPR). Use is voluntary – you can always write to us via the contact form instead.
8. Booking, account and contract
When you book a course, private lessons, a trip or a book, we process the data we need for the contract:
- First and last name, email address, phone number
- Billing and, if applicable, delivery address; for companies the company name and VAT ID
- Booked courses, dates, learning progress and invoices
- Payment data (e.g. IBAN for SEPA direct debit)
- Communication with us and your teachers
The legal basis is Art. 6 (1) (b) GDPR (contract). For your account we also store your login details; your password is only stored in encrypted form. Your dates are synchronised with your teacher’s Google Calendar and our calendar so that both sides see the same dates.
We are required to retain invoices and booking documents under commercial and tax law (usually 6 or 8 years, Art. 6 (1) (c) GDPR). We delete other data when it is no longer needed.
With your first booking we automatically create a customer account for you and send you a link to set your password.
Refer a friend: If you invite someone via “Freunde werben” (refer a friend), we store the email address and – if you provide it – the first name you enter. This allows us to assign a later booking by this person to your invitation and issue the vouchers. We do not contact the invited person ourselves; you send the message. If the person does not book within 90 days, we automatically delete their email address and name. If they book, we store the assignment for as long as we need it for the vouchers and our retention obligations. The legal basis is our legitimate interest in a fair referral programme (Art. 6 (1) (f) GDPR) and the handling of the programme with you (Art. 6 (1) (b) GDPR).
My area: In your account we show you your courses and dates, your attendance, make-up options, invoices and certificates of attendance. Your teachers enter attendance and learning progress. The legal basis is Art. 6 (1) (b) GDPR.
Messages: In your account you can write to your teacher and your course group. We store your message and the time and display your first name with the first letter of your last name. The people in the respective chat can read it – in the group chat everyone in your group and the teacher – and we as the school, where necessary, for example to check a report. You can delete your own messages at any time. We store the other messages for as long as your account exists. The legal basis is Art. 6 (1) (b) GDPR (lessons) and Art. 6 (1) (f) GDPR (a safe, respectful exchange).
Community (voluntary): Only if you switch on the community can people with whom you share a course see your profile: first name with initial, your shared courses, your “About me” text and whether you are looking for someone to practise with. You can then write to each other directly. We do not show your email address or phone number. The legal basis is your consent (Art. 6 (1) (a) GDPR). You can withdraw it at any time by switching off the community in your account – your profile is then immediately invisible. If you block someone, we store this in your account. If you report a message or a profile, we store the report, the reported content and who reported it in order to review the case (Art. 6 (1) (f) GDPR). We delete resolved reports when they are no longer needed.
Invoices: We create our invoices with Lexware Office by Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany. For this we transmit name, billing address, email address and the services booked. We have a data processing agreement with Lexware. The legal basis is Art. 6 (1) (b) and (c) GDPR.
9. Payment
Payments are processed by our payment service provider (Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands, or Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). For this we pass on the necessary payment data to the provider (Art. 6 (1) (b) GDPR). Their privacy notices also apply.
10. Online lessons with Google Meet
We hold our lessons with Google Meet by Google Ireland Limited (address see above). Video, audio, your name and technical connection data are processed. The legal basis is Art. 6 (1) (b) GDPR. You can switch off your camera and microphone at any time.
If the teacher switches on the transcription function, a written record of what is said is created. It is stored in the organiser’s Google Drive and is used to follow up on lessons and provide learning material. Google Meet shows you when transcription is running. The legal basis is Art. 6 (1) (b) and (f) GDPR.
11. Disclosure for book orders
If you order a book, we pass on your name, delivery address and email address to our publishing partner or shipping provider so that the book is delivered directly to you (Art. 6 (1) (b) GDPR).
12. Study trips
For study trips we pass on the necessary data (e.g. name, date of birth, passport details, dietary requirements) to our partners on site such as hotels and language schools, including in countries outside the EU. This is necessary to carry out the trip (Art. 6 (1) (b) GDPR, Art. 49 (1) (b) GDPR). If you would like recognition as educational leave, we also use your details for the certificate.
13. Applications
If you apply to us, we process your application documents for the application procedure (Art. 6 (1) (b) GDPR, Section 26 BDSG). If no collaboration results, we delete your documents no later than six months after the end of the procedure, unless you consent to longer storage.
14. Statistics and advertising
Consent: We only use the following services if you agree in the cookie banner (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). You can change or withdraw your choice at any time via the “Cookie settings” link at the bottom of every page. Without consent these services do not set cookies; Google then receives at most anonymous signals without cookies (Google Consent Mode).
Google Tag Manager: With Google Tag Manager (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) we integrate the services Google Analytics and Google Ads. The Tag Manager itself does not set cookies or analyse data, but processes your IP address in order to deliver the scripts.
Google Analytics 4 (statistics): If you agree to the “Statistics” category, Google Analytics records how our website is used – e.g. pages viewed, time spent, origin (for example via a search or ad), device and approximate location. Cookies (e.g. _ga) are set for this. IP addresses are not stored by Google Analytics 4. For bookings we transmit the order number, the services booked and the amount, but no names or email addresses. The data is deleted after 14 months.
Google Ads (marketing): If you agree to the “Marketing” category, we use Google Ads to measure whether someone books with us after clicking on one of our ads (conversion tracking) and can later show ads to visitors of our website (remarketing). Cookies (e.g. _gcl_au) with a lifetime of up to 90 days are set for this.
With all Google services, data may be transferred to Google LLC in the USA. Google is certified under the EU-US Data Privacy Framework. Further information: policies.google.com/privacy.
Visitor statistics by Jetpack: For simple visitor counting we use Jetpack Stats (Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA). No cookies are set. Technical data about your visit is processed (e.g. page viewed, browser, IP address); this may involve a transfer to the USA. The legal basis is our legitimate interest in simple reach measurement (Art. 6 (1) (f) GDPR).
15. Social media and reviews
On our website we link to our profiles on Instagram, YouTube, LinkedIn and TikTok and to our reviews on Google and Trustpilot. These are simple links: only when you click on them are you redirected to the respective platform. The privacy notices of the respective provider apply there.
16. Your rights
You have the right at any time to:
- Access to your stored data (Art. 15 GDPR)
- Rectification of incorrect data (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Withdrawal of consent with effect for the future (Art. 7 (3) GDPR)
You can also lodge a complaint with a data protection supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany.
17. Right to object
If we process your data on the basis of our legitimate interest (Art. 6 (1) (f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). You can object to advertising by email at any time without giving reasons. An email to info@arabvista.net is sufficient.
18. Changes
If our services or the legal situation change, we will adapt this privacy policy. The current version on this page always applies.
Last updated: November 2026