Privacy Policy

​

Last updated: 5 October 2026

​

Privacy at a Glance

We take the protection of your personal data seriously. This Privacy Policy explains which data is processed when you visit our website, contact us or book our events, the purposes of that processing and your rights.

This Privacy Policy applies to our website at www.erstehilfekursberlin.de, including the integrated Wix ticket shop. When using linked services that operate on separate technical platforms, please also refer to the privacy notices provided there.

​

Data Controller and Contact Details

The controller responsible for processing personal data on this website is:

Erste Hilfe Station Andreas Borucki
Andreas Borucki
Geygerstraße 17
12043 Berlin
Germany

Email: erstehilfestation@mailbox.org
Telephone: +49 30 8145400-0

​

The address above is a postal address, not a course venue. Further information about our business is available in our Legal Notice.

If you have questions about data protection or wish to exercise your rights, you can contact us using the details above. Please provide only the information necessary for us to deal with your request.

​

Purposes and Legal Bases for Processing

We process personal data to provide our website, respond to enquiries, handle course bookings, deliver events and process payments. Data may also be required to comply with legal obligations, maintain the security of our systems and establish, exercise or defend legal claims.

Depending on the processing activity, the following legal bases may apply:

• Consent: Article 6(1)(a) of the General Data Protection Regulation (GDPR), where you voluntarily consent to a specific processing activity.

• Performance of a contract: Article 6(1)(b) GDPR, where processing is necessary for a contract with you or to take steps at your request before entering into a contract.

• Legal obligations: Article 6(1)(c) GDPR, particularly where statutory retention or record-keeping requirements apply.

• Legitimate interests: Article 6(1)(f) GDPR, for example to operate our website securely, handle general business enquiries or establish and defend legal claims, provided that your interests or fundamental rights do not override those interests.

 

These legal bases are set out in Article 6 GDPR. The purposes and legal bases applicable to individual processing activities are explained below.

​

Website Provision and Hosting by Wix

Our website and its integrated ticket shop operate using Wix. Wix provides the technical infrastructure and functions required to display the website and process enquiries and bookings.

The provider is Wix.com Ltd., Yunitsman 5 St, Tel Aviv, Israel; when processing the personal data of visitors and customers of our website as part of the services it provides, Wix generally acts as a processor (Wix Privacy Policy). This processing is governed by Wix's data processing terms, which Wix describes as a binding agreement with its users (Wix's information on its Data Processing Agreement).

When you access our website, technical information needed to transmit, display and secure the website is processed. This may include your IP address, the time of access and the resource requested, browser and device information, and technical error and security information.

This processing serves to provide our website, detect and prevent disruptions and misuse, and investigate technical errors. Where personal data is processed for these purposes, we rely on Article 6(1)(f) GDPR; our legitimate interest is to provide a functional and secure online service.

Data processed by Wix on our behalf in connection with a booking or enquiry is subject to the purposes and legal bases described in the relevant sections below. Information about Wix's processing, its service providers and international transfers is available in the Wix Privacy Policy.

​

Cookies, Consent and Wix Analytics

Our website uses cookies and similar technologies. These may be needed, for example, to provide security functions, operate a shopping cart or remember your choices regarding optional technologies.

Where storing information on your device or accessing information on it is strictly necessary to provide a digital service you have explicitly requested, consent is not required under Section 25(2), point 2 of Germany's Telecommunications and Digital Services Data Protection Act (TDDDG) (Lower Saxony data protection authority's guidance on the TDDDG). Any subsequent processing of personal data also requires an appropriate legal basis under the GDPR, such as Article 6(1)(b) for necessary booking functions or Article 6(1)(f) for security functions (Rhineland-Palatinate data protection authority, GDPR).

​

For non-essential cookies or comparable access to your device, we obtain your consent through the cookie banner. The legal basis is Section 25(1) TDDDG and, where personal data is processed, Article 6(1)(a) GDPR (Rhineland-Palatinate data protection authority).

Wix also provides analytics within the website dashboard; in particular, Wix distinguishes between visitor analytics that depend on consent and reports based on business or transaction data generated in the ordinary course of operations (Wix's information on analytics and consent). Where we use visitor analytics involving non-essential cookies or comparable identifiers, we do so only with your consent; booking-related reports, by contrast, are used to manage and administer our courses.

​

You can decline optional processing and change your choices using the cookie settings accessible on the website. You may withdraw your consent there at any time with effect for the future; this does not affect the lawfulness of processing carried out before withdrawal (Article 7(3) GDPR).

Your consent choices are stored so that we can respect them and, where necessary, provide evidence of them. Personal data contained in consent records is processed to fulfil our data protection accountability obligations under Article 6(1)(c), read together with Article 7(1), GDPR (GDPR).

You can also delete cookies or restrict their storage through your browser settings. This may affect essential website functions; browser settings do not replace the choices for optional processing offered on our website (Wix's information on cookies).

​

Contacting Us

If you contact us by email, telephone or a contact form provided on our website, we process your contact details and the content of your enquiry. We use this information to deal with your request and, where appropriate, communicate with you further.

For enquiries relating to a contract with you or a booking you wish to make, processing is based on Article 6(1)(b) GDPR. We handle other enquiries on the basis of Article 6(1)(f) GDPR; our legitimate interest is to maintain organised and traceable communication with prospective customers and business contacts.

​

Course Bookings, Participation and Billing

When you book our events, we process the data required to reserve places, deliver the event and arrange billing. Depending on the booking, this may include your name, contact details, billing address, company or employer where applicable, selected course, date, participant details and payment status.

We use this data to reserve course places, confirm bookings, communicate organisational changes, deliver events and issue invoices and certificates of attendance. Processing for a contract with you is based on Article 6(1)(b) GDPR; statutory retention and record-keeping are based on Article 6(1)(c) GDPR.

​

Providing the information marked as required is necessary for us to process the relevant booking. Without this data, we may be unable to complete your booking or properly provide the booked service.

​

Where a company books on behalf of its employees, we process the contact and participant details supplied to organise the agreed training. If a participant is not personally a party to the contract, we rely on Article 6(1)(f) GDPR; our legitimate interest and that of the booking company are to organise, deliver and document the booked event.

​

If participant data is supplied by the booking employer or another person making the registration, we obtain the data from that source. This includes, in particular, the name, contact and course details necessary to register the participant and match them to the booking; where legally required, we provide additional information about this indirect collection of data in accordance with Article 14 GDPR.

​

Where billing through your employer, a Berufsgenossenschaft (German statutory occupational accident insurance association) or another statutory accident insurance institution has been agreed, we transmit the necessary participant, course, attendance and billing details to the relevant organisation. Depending on the circumstances, processing is necessary to perform a contract, comply with legal obligations or pursue the legitimate interest in delivering and billing for the agreed training.

​

Payment Processing

For bookings that involve a charge, the data necessary to process the payment is processed. The payment service providers involved depend on the payment method you select from those offered during the booking process.

We process the booking amount, transaction reference and payment status to match the payment to your booking and handle billing. The necessary processing is generally based on Article 6(1)(b) GDPR and, where statutory retention requirements apply, Article 6(1)(c) GDPR.

​

PayPal

If you select PayPal as your payment method, the payment and transaction data required to complete the payment is transmitted to PayPal or collected directly by PayPal. For users in the European Economic Area, PayPal identifies PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, in particular, as the relevant entity (PayPal Privacy Statement).

PayPal also processes data for its own purposes, such as fraud prevention and compliance with legal obligations, and may act as an independent controller for that processing (PayPal Privacy Statement). Information about data categories, recipients, international transfers, retention periods and your rights in relation to PayPal is available in the PayPal Privacy Statement.

​

Stripe

If a payment is processed through Stripe, Stripe processes the payment and transaction data necessary for that purpose. Stripe's contracting entities for businesses in the European Economic Area include Stripe Payments Europe, Limited, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland (Stripe's information on its contracting entities).

Stripe may act as a processor when handling payments and as an independent controller for certain purposes of its own, particularly security, fraud prevention and compliance with legal obligations (Stripe Privacy Center). The relevant Stripe entities, processing activities, international transfers and rights are explained in Stripe's Privacy Policy.

​

Recipients and International Transfers

Personal data is not disclosed indiscriminately or without a legal basis. Recipients may include service providers used to operate the website and handle bookings, your selected payment service provider and, depending on the booking or billing arrangements, employers and statutory accident insurance institutions.

​

Data may also be disclosed to authorities or other authorised bodies where a legal obligation requires this. Where service providers process data solely on our behalf, this is subject to the requirements for processors under Article 28 GDPR.

The use of Wix and payment service providers may involve processing outside the European Union or European Economic Area, particularly in Israel or the United States (Wix, PayPal, Stripe). The European Commission has adopted an adequacy decision for Israel; for the United States, an adequacy decision applies to organisations participating in the EU-US Data Privacy Framework within its scope (European Commission information on adequacy decisions).

​

Where no applicable adequacy decision exists, appropriate safeguards, such as EU Standard Contractual Clauses, or other legally recognised transfer mechanisms are used, as described by the respective service provider (Wix, PayPal, Stripe). Information and, where applicable, copies of the safeguards relevant to a particular transfer are available through the linked provider information or by contacting us.

​

Retention and Deletion

We retain personal data only for as long as it is needed for the relevant processing purpose. Data may be retained beyond that period where justified by legal obligations or the necessary establishment, exercise or defence of legal claims (Article 5(1)(e) and Article 17(3) GDPR).

In particular, the following criteria determine retention periods:

• Enquiries: The period needed to handle the enquiry, including any necessary follow-up communication; if a contract results, the criteria for contractual records also apply.

• Booking and participant data: The period needed to prepare, deliver and follow up on the event, together with any applicable record-keeping and retention periods.

• Invoices and billing records: The applicable statutory retention periods under commercial and tax law.

• Technical logs: The period needed to operate the website, resolve errors, prevent misuse and investigate specific security incidents.

• Consent records: The period during which consent choices must be implemented technically and the lawfulness of processing based on those choices may need to be demonstrated.

• Legal claims: The period during which data is necessary to assess or pursue a claim or defend against legal proceedings.

Once the purpose no longer applies and any retention obligations preventing deletion have expired, the relevant data is deleted or anonymised. Processing carried out by payment service providers as independent controllers is also subject to the retention rules described in their linked privacy notices (PayPal, Stripe).

​

Security and Encrypted Transmission

Our website uses HTTPS/TLS encryption to protect data transmitted between your browser and the website. Encryption is one element of our technical security measures and does not guarantee complete protection.

Please note that communication by ordinary email, in particular, may involve security risks. Please therefore avoid sending us confidential information that is not necessary for your enquiry or booking.

​

Your Data Protection Rights

Subject to the applicable legal requirements, you have the following rights in particular:

• Access: Information about the processing of your personal data under Article 15 GDPR.

• Rectification: Correction of inaccurate data or completion of incomplete data under Article 16 GDPR.

• Erasure: Deletion of your data under the conditions set out in Article 17 GDPR.

• Restriction: Restriction of processing under Article 18 GDPR.

• Data portability: Receipt or transmission of the data you have provided under the conditions set out in Article 20 GDPR.

• Objection: The right to object to certain processing activities under Article 21 GDPR.

• Withdrawal of consent: Withdrawal with effect for the future under Article 7(3) GDPR.

The legal requirements and possible limitations are set out in the relevant provisions of the GDPR. To exercise your rights, please contact us using the details provided above.

​

Right to Object to Processing Based on Legitimate Interests

Where we process personal data on the basis of Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation (Article 21(1) GDPR). We will then cease processing the data concerned unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims (Article 21(1) GDPR).

Where personal data is processed for direct marketing, you may object at any time; this also applies to profiling connected with such direct marketing (Article 21(2) GDPR). Following such an objection, the data must no longer be processed for those purposes (Article 21(3) GDPR).

​

Complaints to a Supervisory Authority

If you believe that the processing of your personal data infringes data protection law, you may lodge a complaint with a data protection supervisory authority, particularly in the place of your habitual residence, place of work or the alleged infringement (Article 77 GDPR). For our business in Berlin, you may contact the following authority in particular:

Berlin Commissioner for Data Protection and Freedom of Information
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61
10555 Berlin
Germany
Email: mailbox@datenschutz-berlin.de
Contact details and further information

​

Linked Services

Our website contains links to other services and websites, including a technically separate sales platform on Shopify. If you follow such links, further processing takes place on the respective destination website; please refer to the privacy notices provided there.

​

Changes to This Privacy Policy

We update this Privacy Policy when our website, the services we use or legal requirements change. The version published on this website is the applicable version.