Privacy Policy
Last updated: October 2026
1. Controller
imb24 GmbH
Gassebrehe 49
49170 Hagen a.T.W.
Germany
Represented by the managing director Dipl.-Ing. Carsten Wolters
E-mail: info@imb24.com · Phone: +49 151 58110445
We are not required to appoint a data protection officer under Art. 37 GDPR and Section 38 BDSG. Please send questions about data protection to info@imb24.com.
2. Overview
We process personal data only as far as necessary to operate this website, answer inquiries, deliver booked trainings, provide our software and comply with legal obligations. We do not use advertising or tracking cookies, do not load fonts, scripts, maps or videos from third-party servers and do not share data for advertising purposes.
The main legal bases are Art. 6(1)(b) GDPR (contract and pre-contractual measures), Art. 6(1)(c) GDPR (legal obligation) and Art. 6(1)(f) GDPR (legitimate interest). Where we rely on a legitimate interest, we name it in the respective section. We only ask for consent for recordings of trainings (section 10).
3. Hosting
The website, database and backups are stored on servers of Contabo GmbH, Aschauer Straße 32a, 81549 Munich, in data centers in Germany. Contabo processes the data on our behalf under a contract pursuant to Art. 28 GDPR. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and reliable operation.
4. Accessing the website and logs
When you access the website, your browser necessarily transmits data such as the IP address, date and time, requested address, referrer and browser and operating system identifiers. We need this data to deliver the pages and keep the system secure (Art. 6(1)(f) GDPR).
Our application does not write access logs containing IP addresses. Error messages of the application contain no IP addresses and no form contents; they are continuously overwritten once the log reaches its size limit and deleted after 30 days at the latest.
5. Protection against misuse (request limits)
To protect forms and interfaces against automated mass requests, we count requests per IP address (for IPv6 per address range) in fixed time windows of one minute up to one hour. For this purpose the IP address is used only in the server's memory, is not stored in the database or in logs and is discarded at the latest when the application restarts. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protection against misuse and overload.
6. Cookies
We only use cookies that are strictly necessary for the service you request (Section 25(2) No. 2 TDDDG). No consent is required for them; therefore we do not show a cookie banner.
| Cookie | Purpose | Lifetime | Who receives it |
|---|---|---|---|
NEXT_LOCALE |
stores the selected language if it differs from your browser's language setting | 1 year | visitors who switch the language |
__Host-imb24_admin |
login to the administration area | 12 hours (ends after 2 hours without activity) | our administrators only |
__Host-imb24_admin_2fa |
login step between password and second factor | 5 minutes | our administrators only |
training_preview, theme_preview |
preview of content and designs before publication | session or 1 hour | logged-in administrators only |
__prerender_bypass |
preview mode of the framework (Next.js) | session | logged-in administrators only |
We do not store data in other browser storage (e.g. local storage).
7. Analytics with Umami
To understand which content is used, we count page views with the open-source software Umami, which we run ourselves on our server in Germany. Recording takes place exclusively on our server: when delivering a page, our application reports the page view to Umami. No tracking script runs in your browser for this, no cookies are set and no information is stored in or read from your device. Consent under Section 25 TDDDG is therefore not required. No data goes to third parties.
Only details that your browser transmits with every page request anyway are used: the requested address (without query parameters), the referrer (domain and path only), the preferred language and the browser and operating system family from the browser identifier. For statistics by country of origin we pass only a shortened IP address to Umami (IPv4 without the last byte, IPv6 only the first 48 bits); the approximate origin (country, where applicable region) is derived from it. Umami never receives the full IP address, and no IP address is stored. Pages whose address contains personal access keys (such as the booking confirmation) are not recorded. If your browser sends a “Do Not Track” or “Global Privacy Control” signal, your visit is not counted. To group page views into a visit, Umami may compute a hash with a key that changes regularly, at least monthly; recognition beyond that period is therefore not possible.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is designing our offer according to actual demand. You can object to this processing at any time (section 17). We delete the raw data after 24 months.
8. Contact form and inquiries
When you contact us via the contact form, by e-mail or by phone, we process your details to answer your inquiry. In the form, name, e-mail address and message are required; without them we cannot handle your inquiry. Company and phone number and, for in-house requests, course, number of participants and preferred period are voluntary. We also store the selected topic. The legal basis is Art. 6(1)(b) GDPR where your inquiry aims at a contract, otherwise Art. 6(1)(f) GDPR (answering your request). We store form inquiries in our database and forward them by e-mail to info@imb24.com.
To protect against automated spam we use ALTCHA: your browser solves a small computational task that our own server issues and verifies. No data is transferred to third parties and no cookies are set.
We delete inquiries 24 months after they have been closed; inquiries that were never closed 36 months after their last change. If a contract results from an inquiry, the periods for booking and contract data apply.
The contact page may offer a link to book an initial call. The link leads to the appointment booking of our calendar service (currently Google Workspace, section 12); data is only processed there once you open it.
9. Booking trainings
Our trainings are directed exclusively at businesses. For a booking we process the data of the booking company (company name, contact person, e-mail address, phone number, billing address, country, VAT identification number, purchase order number, payment method) as well as the names and e-mail addresses of the participants. The purposes are seat reservation, booking confirmation, invitation with calendar entry, reminders and access data for online dates, invoicing, payment processing, cancellation and certificates of attendance (Art. 6(1)(b) GDPR; for participants' data Art. 6(1)(f) GDPR, our legitimate interest being the performance of the contract concluded with the company). Without these details we cannot accept a booking. If you name participants, please inform them about this privacy policy.
We also protect the booking form with ALTCHA against automated submissions (as described in section 8: a computational task issued by our own server, no transfer to third parties, no cookies; Art. 6(1)(f) GDPR, our legitimate interest being protection against abuse).
For companies located in another EU member state we verify the VAT identification number via the VAT Information Exchange System (VIES) of the European Commission. The country code and number are transmitted; we store the result (valid/invalid, where provided the registered name and address) as evidence for the VAT treatment (Art. 6(1)(c) GDPR in conjunction with VAT law). Without a confirmed valid number an online booking is not possible; no further automated decision-making or profiling takes place.
For invoicing, our office receives the invoice data by e-mail; we issue the invoice with our banking and accounting service provider, and our tax advisor receives the records (Art. 6(1)(c) GDPR).
To limit mass reservations we additionally store the domain of the e-mail address. We delete it once the reservation has ended and the booking is older than 30 days.
Retention: Booking and invoice data are subject to retention obligations of 8 or 10 years under commercial and tax law (Section 257 HGB, Section 147 AO). We delete bookings 10 years after the end of the calendar year of the last accounting-relevant event (booking, payment, cancellation, refund or end of the course). We anonymize participants' names and e-mail addresses 3 years after the end of the course; only the certificate number is kept so that we can confirm its authenticity. Reservations that were not confirmed or not paid and have no payment transaction are deleted 24 hours after the reservation expired; if the Stripe payment process was started, within 30 days after the reservation expired, so that late payment notifications (e.g. SEPA direct debits) can still be matched. If a payment transaction exists for a reservation, we keep it like a booking. Cancelled bookings without a payment transaction (no payment, no invoice, no cancellation fee, no refund) are deleted 12 months after the cancellation.
10. Online trainings
Online trainings take place live via a video conferencing service; participants receive the access link with the invitation or reminder. If we use a service from Google Workspace, section 12 applies. We do not record trainings unless this is announced in the course description and all participants have consented (Art. 6(1)(a) GDPR).
11. Payment processing with Stripe
If you pay online, we redirect you to Stripe's payment page. The provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. We transmit the amount, the course name, your e-mail address and an internal booking reference to Stripe; on the payment page you enter your billing address and payment details for the payment methods offered there (e.g. card or SEPA direct debit) directly with Stripe. Stripe processes the data to execute the payment and prevent fraud. We only receive the payment status and a payment reference, no card or account data. The legal basis is Art. 6(1)(b) GDPR.
Stripe may transfer data to Stripe, Inc. in the USA. This is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework, under which Stripe is certified, and additionally on standard contractual clauses. More information: https://stripe.com/privacy
We do not embed any Stripe scripts on our own pages; Stripe is only loaded after the redirect.
12. E-mail with Google Workspace
We send and receive our e-mails (booking confirmations, invitations, reminders, certificates, replies to inquiries) via Google Workspace. The provider is Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland. Google processes the data on our behalf under a contract pursuant to Art. 28 GDPR. A transfer to the USA is possible; Google LLC is certified under the EU-US Data Privacy Framework, and standard contractual clauses apply in addition. The legal basis is Art. 6(1)(b) GDPR, for general correspondence Art. 6(1)(f) GDPR.
Automatically generated e-mails are placed in a queue in our database before sending. After successful sending they are archived after 12 hours and deleted 7 days later; undeliverable e-mails remain for 30 days for troubleshooting and are then also deleted after 7 days.
13. License check of the RR-Tool
Our RR-Tool (Risk Reward Pro for cTrader) queries our license interface when a trial version starts. A license key containing the user ID of your cTrader account is transmitted. We store the key, expiry date and status of the license and log the time, path, result and truncated IP address of each call (IPv4 without the last octet, IPv6 only the first three blocks). The purpose is providing the 14-day trial license and preventing misuse (Art. 6(1)(b) and (f) GDPR).
We delete the call logs after 30 days and trial licenses 24 months after their expiry. Licenses from purchases are kept as long as they can be used.
14. Interfaces for software agents
If we have enabled booking interfaces for software agents (e.g. AI assistants), such systems can, on behalf of a company, retrieve course information, make non-binding seat reservations or request in-house offers. We process the submitted details (company and contact data, participants, message) as described in sections 8 and 9. A reservation only becomes binding when a person confirms it via the link we send to the e-mail address provided; unconfirmed reservations expire after 24 hours and are deleted as described in section 9. Section 5 applies to request limits. The legal bases are Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (protection against misuse).
15. Certificates of attendance
After a course we create certificates of attendance as PDF with name, course, date, duration, content and a serial number and send them by e-mail to the participants (Art. 6(1)(b) GDPR). We do not keep the PDF permanently, only the number and date of issue; until the anonymization after 3 years we can reissue a certificate.
16. Recipients and transfers to third countries
Personal data is only received by the service providers named in this policy, our banking and accounting service provider, our tax advisor and authorities where we are legally obliged. Transfers to countries outside the EU only take place as described in sections 11 and 12.
Our website links to other offers (e.g. videos on YouTube, a map service or the shop of a software marketplace). This content is not embedded; data is only transferred when you open such a link, and the privacy notices of the respective provider then apply.
17. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). Please contact info@imb24.com. Data that we may not delete due to statutory retention obligations is restricted until the end of the retention period. We document the completion of an erasure for 3 years as proof, without storing your e-mail address in plain text (Art. 6(1)(c) GDPR in conjunction with Art. 5(2) GDPR).
You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR); the lawfulness of the processing carried out until the withdrawal remains unaffected.
Right to object: Where we process data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection of Lower Saxony (Landesbeauftragte/r für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hannover, Germany.
18. Retention periods at a glance
| Data | Period |
|---|---|
| Booking and invoice data | 10 years after the end of the calendar year of the last accounting-relevant event |
| Participants' names and e-mail addresses | anonymized 3 years after the end of the course |
| Unconfirmed or expired reservations without a payment transaction | 24 hours after expiry; after a started Stripe payment process within 30 days after expiry |
| Cancelled bookings without a payment transaction | 12 months after the cancellation |
| Contact inquiries | 24 months after closing, unclosed ones 36 months after their last change |
| E-mail domain of reservations | 30 days after the booking, not before the reservation has ended |
| E-mail queue | 7 days after archiving; undeliverable e-mails after 37 days |
| License interface logs | 30 days |
| RR-Tool trial licenses | 24 months after expiry |
| Analytics raw data | 24 months |
| Backups | 30 days |
19. Data security
All connections to this website are encrypted with TLS; we send e-mails only over encrypted connections. The administration area is protected by a password and a second factor (one-time code); logins and changes are logged. Database backups are created daily, transferred encrypted, stored on storage in Germany that is only accessible with access keys, and deleted after 30 days. Deletions and anonymizations therefore also take effect in the backups after 30 days at the latest.
20. Changes
We update this privacy policy when our processing or the legal situation changes. The version published here applies. The German version is legally binding.