Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

BeConcrete L.L.C-FZ
Meydan Grandstand, 6th floor, Meydan Road
Nad Al Sheba, Dubai
United Arab Emirates
E-mail: support@merke.me

2. Representative in the EU (Art. 27 GDPR)

Because the controller is established outside the EU but offers the service to individuals in the EU, the GDPR applies (Art. 3(2) GDPR). We have designated the following representative in the Union:

[EU-Vertreter: Name / Gesellschaft]
[EU-Vertreter: Anschrift in der EU]
E-Mail: [eu-vertreter@...]

3. Overview

merke.me is a learning platform for the German language. We process personal data only to the extent necessary to provide the service, to perform the contract, or to comply with legal obligations. We do not sell data and do not run third-party advertising.

4. Hosting and server log files

The platform runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (processing on our behalf under Art. 28 GDPR). When the pages are accessed, the web server automatically processes technical access data (IP address, date and time, requested URL, referrer, user agent). This data is required for the technical operation and security of the service (Art. 6(1)(f) GDPR) and is deleted after no more than 14 days unless it is needed to investigate specific cases of misuse. The country is also derived from the IP address to enforce regional availability (exclusion of the UAE, see Terms of Service) and to display prices in the local currency; the evaluation is at country level only and no location profile is stored. The country database used for this is identified in the Legal Notice.

5. Cookies and local storage

We use only technically necessary cookies, in particular:

• a session cookie for login,
• a cookie storing the chosen interface language (`locale`).

In addition, the application stores settings (e.g. colour scheme, dismissed dashboard cards) in your browser's local storage (localStorage). This data does not leave your device. As no consent-requiring cookies are used, no cookie banner is required.

6. Registration and user account

An account is required to use the learning features. We process: e-mail address, optionally name and profile picture, password (only as a hash), language settings, and your learning data (activated decks, progress, review statistics, achievements). The legal basis is performance of the contract (Art. 6(1)(b) GDPR). When an account is deleted, the associated data is deleted unless statutory retention obligations (e.g. for invoicing data) apply.

7. Sign-in with Google

Optionally, you can sign in with your Google account. In that case we receive from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) your name, e-mail address, profile picture and a Google account ID. The legal basis is performance of the contract (Art. 6(1)(b) GDPR); using Google sign-in is voluntary. Google's privacy notices apply in addition.

8. Payment processing (Stripe)

Paid subscriptions are processed via the payment provider Stripe (for customers in the EEA: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). The data required for payment (e-mail address, amount, payment method) is transmitted to Stripe. We neither collect nor store full payment details (e.g. card numbers). We store subscription status as well as invoicing and tax data. Legal bases: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(c) GDPR (tax and commercial retention obligations).

9. E-mail delivery (SMTP)

To send e-mails (account verification, password reset and - which you can switch off - learning reminders and progress summaries) we use an SMTP service. The e-mail address and the content of the respective message are processed. Legal bases: Art. 6(1)(b) GDPR for transactional e-mails, Art. 6(1)(f) GDPR for learning reminders to existing users; every reminder e-mail contains an unsubscribe link, and you can disable delivery in your settings at any time.

10. Web analytics (self-hosted, cookieless)

To measure reach we use self-hosted analytics software (Umami). The analytics work without cookies, do not create cross-device profiles and do not store IP addresses permanently; only aggregated data such as page views, referrers and rough device information is evaluated. The data remains on our own servers in Germany. The legal basis is our legitimate interest in improving the service as needed (Art. 6(1)(f) GDPR).

11. Transfers to third countries

The controller is established in the United Arab Emirates (UAE) - a third country for which the EU Commission has not issued an adequacy decision. Where personal data is transferred to or processed in the UAE for administration, customer care, billing or support, we rely on appropriate safeguards within the meaning of Art. 44 et seq. GDPR, in particular the EU Commission's Standard Contractual Clauses supplemented by any necessary additional measures. A transfer to the USA by Stripe is possible; Stripe relies on Standard Contractual Clauses and the EU-US Data Privacy Framework. You can request a copy of the safeguards via the contact details above.

12. Storage period

We store personal data only for as long as necessary for the stated purposes: account data until the account is deleted; server log files for up to 14 days; invoicing and payment data for the duration of the statutory retention periods.

13. Recipients and processors

Recipients of personal data are solely the service providers named in this policy (Hetzner, Stripe, the SMTP/e-mail provider, and Google where Google sign-in is used). Contracts under Art. 28 GDPR are in place with processors.

14. Your rights

You have the following rights regarding your personal data:

• access (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR),
• withdrawal of consent with effect for the future (Art. 7(3) GDPR).

To exercise them, a plain e-mail to support@merke.me or to our EU representative is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

15. Data security

Transmission is encrypted (TLS/HTTPS). Passwords are stored only as a salted hash. Server access is limited to the necessary minimum.

16. Changes to this policy

We adapt this privacy policy when the service or the legal situation changes. The version published here at the time applies.