Processing on behalf under Art. 28 GDPR

Subject matter and duration

Kursimple provides you with course management as an online service: courses and dates, online booking and the course website, customer and participant management, invoices and payments and email sending. In doing so we process the personal data that you or your customers enter into Kursimple. The agreement runs for as long as your contract for the use of Kursimple.

Data subjects

• your customers and bookers, including invoice recipients
• participants in your courses, including children for whom their parents book
• instructors and course leaders
• contacts at external providers, if you use the provider portal
• newsletter subscribers
• your staff who work with Kursimple

Types of data

• master and contact data: name, address, email, phone, date of birth, company
• contract and booking data: orders, dates, waiting lists, subscriptions, vouchers
• invoice and payment data: invoices, incoming payments, reminders, bank details and SEPA mandate
• course data: attendance, reasons for absence, certificates of attendance
• communication: emails sent with attachments, newsletter consents
• documents you assign to a customer and answers to follow-up forms

If you use follow-up forms to ask for special categories of personal data – health information in a health questionnaire, for instance – we process that on your behalf as well. You are responsible for the legal basis and for the consent of your participants.

Our obligations as processor

• We process the data only on your documented instructions and not for our own purposes.
• Everyone at our end who has access to the data is bound to confidentiality.
• We take technical and organisational measures under Art. 32 GDPR. The description of those measures is an annex to the agreement. [Annex on measures to be prepared.]
• We support you with requests from your customers about their rights and with your obligations under Art. 32 to 36 GDPR.
• We inform you without delay if we become aware of a personal data breach.
• After the contract ends we return the data to you on request and then delete it, unless there is a statutory obligation to retain it.
• You may verify compliance with these obligations; we provide the necessary information.

Sub-processors

We engage further processors only with your agreement and contractually bind them to the same data protection obligations. Currently these are:

Company	Service	Location
[to be completed before publication]	Data centre / hosting	Germany
[to be completed before publication]	Email sending	[to be completed]

If you use your own SMTP server for sending mail or offer PayPal as a payment method, your own contracts with those providers apply to those services.