Privacy Policy

1. WHO WE ARE AND WHAT THIS POLICY COVERS

1.1The controller is Jerome Goerke, trading as greentech.training. Data-protection enquiries can be directed to Walid Mensi at data@greentech.training. General enquiries can be sent to info@greentech.training.

1.2This policy explains how we process personal data through our Website at greentech.training, our learning management system (LMS) at glms.greentech.training, Company Accounts, Courses and the Candidate Pool. It covers visitors, Learners, Candidates, Company representatives and Experts. A Learner becomes a Candidate only by choosing to participate in the Candidate Pool.

1.3This policy provides information about processing. Acceptance of our Terms does not constitute consent to optional recruitment visibility, advertising or other optional processing. Where we request consent, we explain the particular purpose separately.

2. WEBSITE ACCESS AND SECURITY

2.1When a visitor accesses the Website or LMS, our systems process the technical information required to deliver the requested pages and protect the service, including IP address, request time, requested resource, response status, browser and operating system, referring page and security events.

2.2We use this information to operate the service, investigate faults and detect unauthorised access or misuse. The legal basis is Article 6(1)(f) GDPR; our legitimate interests are maintaining a functioning and secure service. Visitor IP addresses used to detect and prevent attacks are retained for a maximum of seven days. Routine Website application and LMS access logs are retained for seven days. Relevant incident records may be retained until the incident and any resulting claim are resolved.

3. ACCOUNTS, ENQUIRIES AND PURCHASES

3.1For a Learner Account, we process the Learner's name, email address, authentication information, enrolments and account settings. For a Company Account, we also process the Account Holder's business contact details, role, Company details and account permissions. We retain records of the Terms version accepted and the acceptance date.

3.2We use account information to provide access, administer enrolments and subscriptions, communicate service changes and answer support requests. Where an individual contracts with us personally, processing necessary for that contract or pre-contractual steps requested by that individual is based on Article 6(1)(b) GDPR. Where an individual represents a Company, we rely on Article 6(1)(f) GDPR for our interest in administering that business relationship.

3.3For purchases, we process order details, billing information, payment status, refunds and relevant correspondence. Payments are handled through PayPal and Stripe. The selected provider processes the payment information needed to execute the transaction and carries out its own fraud-prevention and legally required checks. We process the order reference, payment status and relevant transaction information to administer the purchase. Further information: https://www.paypal.com/de/legalhub/paypal/privacy-full and https://stripe.com/privacy. Contract administration is based on Article 6(1)(b) GDPR where the data subject is the contracting customer; business contact administration is based on Article 6(1)(f). Records required under applicable accounting and tax legislation are retained under Article 6(1)(c) GDPR.

3.4Information marked as required is necessary to supply the requested account, purchase or service. Without it, we may be unable to complete that request. Optional profile information is identified separately.

3.5Our ordinary business correspondence mailboxes may be hosted by STRATO. That is separate from this Website's own systems: Website account authentication, account-related emails and enquiry-form submissions are processed using Vercel (hosting), Neon (database) and Resend (email delivery), together with Google reCAPTCHA for bot protection — not Supabase Auth or Web3Forms, which this deployment does not use.

3.6We process information submitted with a Global Green Leader application to assess the application, communicate with the applicant and administer selection. Application files are retained for a maximum of ninety days, or up to twelve months where the applicant separately agrees to extended consideration. That consent can be withdrawn by contacting data@greentech.training.

4. COURSES AND LEARNING RECORDS

4.1greentech.training processes Course enrolment, progress, assessment answers and results, answering speed and accuracy rate, completion records and certificates where these form part of the Course. These records support Course delivery, feedback and confirmation of completion. Where the Learner contracts directly with greentech.training, processing necessary to perform that contract is based on Article 6(1)(b) GDPR.

4.2Experts and Course Administrators receive access to the Learner information necessary to teach, assess, administer and support their assigned Courses. Course Administrators are authorised greentech.training operators. Their access is limited to their assigned responsibilities and does not automatically extend to the Candidate Pool or unrelated learning records. Access by Account Holders and authorised Company personnel is governed separately by Sections 5 and 6.

4.3We do not record Learners' voices, images or contributions.

4.4LMS Course videos are delivered using bunny.net (BunnyWay d.o.o.). Video delivery involves processing the connection and request information needed to transmit the video, and may involve playback-quality and error information. Details of its processing services are available at https://bunny.net/gdpr/.

5. COMPANY-SPONSORED LEARNING

5.1A Company arranging training may provide the Learner's name, business email address, organisational affiliation and Course allocation. We identify the sponsoring Company when providing access. Sponsorship does not itself enrol the Learner in the Candidate Pool.

5.2Where we operate a Company's internal training environment on its instructions, the Company determines the purposes of that processing and we act as its processor. The Company's privacy notice explains its legal basis, employee reporting and retention arrangements.

5.3For sponsored access to Public Courses, greentech.training acts as an independent controller for enrolment, Course delivery, learning records and certification. Where the Learner is not a party to a contract covering that processing, the legal basis is Article 6(1)(f) GDPR: the legitimate interests of greentech.training and the sponsoring Company in providing and administering the requested training. Reporting to the sponsoring Company is limited to Course progress, average answering time in seconds and accuracy percentage. The sponsoring Company acts as an independent controller for its subsequent use of the reports. Sponsored enrolment does not itself authorise inclusion in the Candidate Pool.

5.4For sponsored training, the Account Holder and authorised Company personnel can view three learning metrics for participating staff: Course progress, average answer time in seconds and answer accuracy as a percentage — the same three metrics displayed to authorised recruiting Companies for Candidates who opt into the Candidate Pool. Sponsorship does not give the Company unrestricted access to unrelated Courses, private support correspondence or Candidate Pool information.

5.5Confirmed processing purposes include: Course delivery, progress tracking, automated assessment, feedback and certification; employer-sponsored training reporting; optional Candidate Pool participation; consent-based GA4 measurement of public Website use; and processing payments and administering contractual and accounting records. When employer access to staff training reports ends, we provide the Company a secure export of its own staff names and the three agreed learning metrics, then remove dashboard access and delete processor-held training records within thirty days, subject to lawful instructions and required retention.

6. CANDIDATE POOL AND RECRUITMENT

6.1Participation in the Candidate Pool is optional. With the Candidate's consent under Article 6(1)(a) GDPR, we make the agreed Candidate Information available to Companies authorised to use the recruitment Service so they can identify, assess and contact the Candidate about Opportunities.

6.2When a Learner opts into the Candidate Pool, authorised Companies can view the Candidate's Course progress, average answer time in seconds and answer accuracy as a percentage. The displayed name consists of the Candidate's first name and the first letter of the surname. Full surname and contact details are not automatically displayed. Companies may contact the Candidate through the platform's messaging system; the Candidate decides whether to disclose further details.

6.3Company access is through online viewing without a profile-download function. Companies may create recruitment notes and keep information necessary for their recruitment process. Our Company Terms prohibit scraping, systematic reproduction, sale, public disclosure and unrelated marketing use of Candidate Information.

6.4From its first access, a Company is an independent controller for the recruitment processing it determines. Its own recruitment privacy notice explains its purposes, legal basis, recipients, retention and rights contact.

6.5Candidates may withdraw their Candidate Pool consent at any time via Settings → Recruitment visibility, or by contacting data@greentech.training. This immediately removes the Candidate's profile from search results and denies further profile access, while learning-record access remains intact. Withdrawal does not affect the lawfulness of earlier consent-based processing or automatically erase records already held independently by a Company.

6.6We may process introduction records, recruitment communications and confirmation of an Engagement to administer the recruitment Service, calculate agreed Company fees and resolve disputes, based on Article 6(1)(f) GDPR.

7. AUTOMATED LEARNING FEATURES

7.1The LMS calculates Course progress, average answer time and accuracy. Companies may use these metrics when assessing Candidates. No automated matching algorithm or automatic exclusion is currently deployed; this section will be updated before any such feature is introduced.

8. COOKIES AND EXTERNAL SERVICES

8.1We use strictly necessary cookies and local storage to support authentication and preference storage. Storage or access that is strictly necessary for a service expressly requested by the individual is based on Section 25(2) TDDDG.

8.2The Website uses a built-in consent banner offering “Essential only” and “Accept analytics”. No third-party consent-management provider is used. Google Analytics 4 (GA4) is blocked until the visitor selects “Accept analytics”. It processes standard Website and session data and events including page views, calls-to-action clicked, form starts and submissions, scrolling and engagement, on the public Website only, not the LMS. Consent-based analytics processing relies on Article 6(1)(a) GDPR and Section 25(1) TDDDG for associated device storage. GA4 event and user-data retention is set to two months.

8.3Visitors can reopen the banner at any time through the persistent “Cookie Settings” option. Switching to “Essential only” stops future GA4 tracking immediately and clears GA cookies. This stops future collection; it does not itself erase information already transmitted to Google.

8.4Cookies and local storage in use include _ga and ga* analytics cookies, a cookie-preference record (retained six months, followed by a renewed choice), and — with analytics consent — a first-touch attribution record in browser localStorage.

8.5Our Website includes an external link to our LinkedIn profile. It is not a LinkedIn sign-in function. Following the link leads to an interaction with LinkedIn subject to LinkedIn's own privacy information.

8.6With analytics consent, we store a first-touch attribution record in the visitor's browser containing UTM source, medium and campaign, referrer, landing page and capture time, to understand which referral or campaign brought the visitor to the Website. It expires ninety days after creation. If a visitor withdraws analytics consent, we stop attribution collection and remove this browser record alongside the GA cookies. The legal bases are Section 25(1) TDDDG for browser storage/access and Article 6(1)(a) GDPR for associated personal-data processing.

9. SERVICE PROVIDERS AND INTERNATIONAL ACCESS

9.1We disclose information to providers supporting the functions described above. For this Website, that means Vercel (hosting), Neon (database) and Resend (email delivery), together with Google reCAPTCHA and Google Fonts. Our ordinary business mailboxes may separately be hosted by STRATO. The learning-management system uses its own separate providers (Contabo, bunny.net) and payments use Stripe and PayPal, as those systems connect to this Website. Providers acting on our instructions are engaged under data-processing arrangements; payment providers explain their own processing in their own privacy notices.

9.2Information may also be disclosed to professional advisers where necessary to obtain advice or handle a claim, and to authorities where disclosure is legally required.

9.3Authorised recruiting Companies may be located within or outside the European Economic Area (EEA). Where access constitutes an international transfer, it is provided only under an applicable adequacy decision or another valid transfer mechanism. Vercel, Neon and Resend each incorporate the Standard Contractual Clauses into their standard data-processing agreements, which is the transfer mechanism relied on for the processing they carry out for this Website.

9.4Individuals may contact us for information about the safeguards applicable to their personal data and a copy of the relevant safeguards, with necessary redactions protecting confidential information and other people's data.

10. RETENTION AND DELETION

10.1We retain personal data for the relevant service and delete or irreversibly anonymise it when it is no longer needed, unless a documented legal obligation or claim justifies further retention.

10.2Routine technical access logs are retained for seven days. General enquiries that do not result in a customer relationship are deleted six months after closure. Routine support tickets are deleted twelve months after resolution.

10.3Ordinary account information is deleted within thirty days after account closure. Detailed assessment answers and submissions are retained for twelve months after Course completion, unless continued Course access or a documented programme requirement justifies longer retention. Certificate-verification records are retained for five years from issue, keeping only identity, Course, result where necessary, issue date and certificate identifier.

10.4Candidate visibility ends when participation is withdrawn. Recruitment-only profile information is deleted within thirty days after withdrawal, except for limited records retained for a documented legal obligation or claim. Inactive Candidate profiles are reviewed after twelve months.

10.5Introduction, fee, consent and accounting records are retained only for the applicable documented purpose and period. Company-controlled internal training records follow the Company's documented instructions.

10.6Deleted information may remain in protected backups for up to thirty days, until those backups expire. Backup copies are restricted to recovery purposes.

10.7Invoices, statutory business records, consent evidence and records required for legal claims follow their own retention rules and are kept separate from ordinary account data — they are not used as a reason to retain an entire account indefinitely.

10.8Deletion covers the relevant database records, stored email copies and connected systems. Where deletion is not yet automated for a given record type, a documented manual deletion process with a named owner and schedule applies instead.

10.9For this Website's own submissions: a job posting and its applications are deleted six months after the posting closes or a hiring decision is made. An Expert application not taken forward is deleted six months after that decision. Contact messages, employer waitlist entries, course notifications and syllabus requests are deleted twelve months after being actioned, consistent with the routine-support-ticket period in Clause 10.2.

11. DATA SUBJECT RIGHTS AND CONTACT OPTIONS

11.1Subject to the applicable conditions, individuals may request access, correction, deletion, restriction and data portability. Individuals may withdraw consent at any time without affecting earlier lawful processing.

11.2Individuals may object to processing based on legitimate interests on grounds relating to their particular situation. Individuals may object to direct marketing at any time, including related profiling.

11.3Send requests to the contact in Section 1. We normally respond within one month. If a permitted extension is needed, we explain it within that month.

11.4Individuals may complain to a data-protection supervisory authority, including in the country of their habitual residence or workplace. Our local authority is the Berlin Commissioner for Data Protection and Freedom of Information: https://www.datenschutz-berlin.de/.

12. UPDATES

12.1We update this policy when the service or its processing changes and show the effective date. We provide additional notice where a change materially affects how personal data is used. Publishing an updated policy does not itself provide consent for a new purpose.

13. MINIMUM AGE

13.1Our services are intended for adults aged 18 and over. We do not currently support enrolment or registration by anyone under 18.

14. CONTACT

14.1Questions about this Policy, or requests relating to your personal data, can be sent to data@greentech.training, or via the “Privacy / Legal” category on the Contact page.

14.2Postal correspondence can be sent to greentech.training, Kolonnenstraße 8, 10827 Berlin, Germany — the address published in the Imprint.

14.3The individual cookies and local-storage keys referenced in Clause 8.4 (_ga and ga* analytics cookies, the cookie-preference record, and the first-touch attribution record) are the full current inventory; this Policy is updated if that inventory changes.