Privacy Policy

The controller responsible for processing personal data on this site is the operator named in the Impressum.

• Account data: your email address, an optional name, and a securely hashed password. • Usage data: the practice tests you take, your answers, and your scores. • Payment data: processed by our payment provider (Stripe). We store a record of purchases and credit transactions, not your card details. • Technical data: a strictly necessary session cookie to keep you signed in, and server logs. • Service records: operational notes needed to run the service — for example, that a practice test could not be provided to you and which exam level you had asked for, so that we know when to produce more. • Statistics data (only with your consent): which pages you view, how you reached us, a coarse location derived from a shortened IP address, and technical details of your device and browser. • Advertising data (only with your consent): your interactions with this site — such as opening the registration page or completing a purchase — which the advertising platforms named below match against their own users.

We process your data to provide the service and your account (Art. 6(1)(b) GDPR), to process payments and meet legal record-keeping duties (Art. 6(1)(c) GDPR), and to keep the service secure and plan how much practice content is needed (Art. 6(1)(f) GDPR). Statistics and advertising happen only where you have given consent in our cookie banner: Art. 6(1)(a) GDPR for the processing, and § 25 (1) TDDDG for storing information on and reading it from your device. Consent is given separately for each of the two purposes, and you can withdraw it at any time with effect for the future via "Cookie settings" in the footer of any page. Withdrawal does not affect the lawfulness of processing carried out beforehand.

We use Google Tag Manager, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to load the statistics and advertising services described below. Google Tag Manager itself sets no cookies and collects no personal data of its own; it is only the mechanism by which the other services are loaded, and it is loaded only once you have consented to at least one optional purpose.

With your consent we use Google Analytics 4, a web-analysis service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses cookies to help us understand how the site is used. What is processed: a pseudonymous identifier, your shortened IP address, the pages you view, how you arrived, your interactions with the site, and technical details of your device and browser. Google Analytics 4 shortens IP addresses before they are stored; we never receive your full IP address. We have not enabled Google Signals, so no cross-device tracking or advertising personalisation takes place through this service. Legal basis: your consent, Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. Data is retained for 14 months. You can also prevent collection with Google's browser add-on: https://tools.google.com/dlpage/gaoptout

With your consent we use the following advertising services to measure the effectiveness of our advertising and to show you relevant advertising on those platforms. Each places a small piece of code on this site that records your interactions — for example opening the registration page or completing a purchase — and matches them, using cookies and similar identifiers, against that platform's own users. • Google Ads — Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland • Meta (Facebook, Instagram) — Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland • TikTok — TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland • Reddit — Reddit Ireland Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland • X (Twitter) — Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland Legal basis: your consent, Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. Refusing or withdrawing consent for advertising has no effect on your use of Zertio. Each provider processes the transmitted data for its own purposes as well; details are in that provider's own privacy policy, and we have no influence over that processing.

For the collection of data by the Meta pixel and its transmission to Meta, we and Meta Platforms Ireland Limited are joint controllers within the meaning of Art. 26 GDPR, and we have concluded Meta's controller addendum for this. The joint responsibility is limited to that collection and transmission. Everything Meta does with the data after it has been transmitted is Meta's own responsibility alone. You can exercise your data-protection rights against us or against Meta; Meta undertakes to handle requests concerning its own processing.

The statistics and advertising providers named above are established in Ireland, but data may be transferred to their parent companies in the USA. Google LLC and Meta Platforms, Inc. are certified under the EU-U.S. Data Privacy Framework, for which the European Commission has issued an adequacy decision. In addition, and for the remaining providers, transfers are based on the European Commission's standard contractual clauses under Art. 46 (2) (c) GDPR. You should be aware that US authorities may, under certain conditions, be able to access such data, and that enforcing your rights there may be more difficult than within the EU. If you do not wish this, simply do not consent to statistics or advertising cookies — the site works fully without them.

• Hosting and database provider • Stripe (payments) • Our AI provider (automated scoring of free-text answers) • Object-storage provider (audio files) • Google Ireland Limited (tag management and, with your consent, web analytics) • The advertising providers named above, where you have consented Each processes data on our behalf under a data-processing agreement, except where a provider acts as its own controller or as a joint controller, as described above.

Account data is kept while your account exists. Invoice and payment records are retained for the statutory period (up to 10 years under German law) even after account deletion. Records of practice tests we could not provide are kept for 180 days. Google Analytics data is retained for 14 months. Retention by the advertising providers is governed by their own privacy policies.

You have the right to access, rectify, erase, restrict, and port your data, and to object to processing. To exercise any of these, contact us at matijabojovic@zertio.de; we respond within one month. You also have the right to lodge a complaint with a data-protection supervisory authority. Where we rely on your consent — statistics and advertising — you may withdraw it at any time, and doing so must be as easy as giving it: select "Cookie settings" in the footer of any page. Withdrawal takes effect immediately for the future and does not affect processing already carried out. Refusing or withdrawing has no effect on your use of Zertio.

Besides the strictly necessary cookies needed to keep you signed in and to remember your cookie choice, we set statistics and advertising cookies only with your consent. The Cookie Policy lists every cookie, what it is for and how long it lasts.