Data Protection & GDPR
Data Protection & GDPR Compliance
We take data protection seriously. Here is exactly how your data flows through our system, who handles it, and what rights you have under GDPR.
First: do you run the plugin on your own server, or do we host it for you? If you self-host, you then choose how your students log in — that choice is what determines your data protection level.
How do your students log in?
Suitable for these professions
General guidance based on typical confidentiality needs, not legal advice — assess your own obligations, e.g. under professional confidentiality duties (§ 203 StGB) or Art. 9 GDPR special category data.
Data collected
- ✓ Student names
- ✓ Email address (for the magic link)
- ✓ Availability times
Where it is stored
- → Our servers in Germany, on your behalf
- → Governed by a Data Processing Agreement
GDPR status
- ● Pseudonymous at the solver
- ● Identified in storage
- ● You remain the controller
stored on our infrastructure
- Name: Max Mustermann
- Email: max@example.com
- Availability: Mon/Wed 18–19h
in memory, discarded after
- ID: p7f3a9c2e18b04d6a
- Availability: Mon/Wed 18–19h
- Priority + reliability score
- ✗ No name, no email, no address
shown to you via magic link
- Student #42 → Max Mustermann
- → Re-linked on our side
The badges say who can re-identify at each step. For you as the controller the data stays personal data in every setup — GDPR keeps applying to your practice. What this setup changes is who else can re-identify: nobody.
⚠️ The trade-off you are making here
In this setup we are the processor for the whole pipeline, not just the brief computation — your roster lives on our servers under a Data Processing Agreement.
The email address is unavoidable: a magic link has to be sent somewhere, and an email address identifies a person. If you need the highest level, choose self-hosted with PDF + QR codes instead.
Data collected
- ✓ Student names
- ✓ WordPress account or email, depending on login method
- ✓ Availability times
Where it is stored
- → Your own server, under your sole control
- → Your hosting provider also has infrastructure-level access to your server
- → We see it only in-flight during a solve
GDPR status
- ● Pseudonymous at the solver
- ● Never stored by us
- ● DPA still required
in your WordPress database
- Name: Max Mustermann
- Login: WordPress account or magic link
- Availability: Mon/Wed 18–19h
in memory, discarded after
- ID: p7f3a9c2e18b04d6a
- Availability: Mon/Wed 18–19h
- Priority + reliability score
- ✗ No name, no email, no address
re-identified by you
- Student #42 = Max Mustermann
- → Only your site holds the key
The badges say who can re-identify at each step. For you as the controller the data stays personal data in every setup — GDPR keeps applying to your practice. What this setup changes is who else can re-identify: nobody.
Best for: self-hosted schools — pick whichever login students prefer
Whether a student logs in with a WordPress account you create yourself, or clicks a magic link emailed to them, the privacy outcome is identical: both store a name, and both get pseudonymized the same way before reaching the solver. The only real difference is workflow — magic links let students self-register without your involvement; WordPress accounts let you administer logins yourself, e.g. without needing every student's email address.
Because your database maps the ID back to a name, the data we process stays pseudonymous rather than anonymous, and a Data Processing Agreement still applies.
Data collected
- ✗ No names, no email addresses
- ✓ Only: Student #1, #2, #3…
- ✓ Availability times
Where it is stored
- → Your own server, under your sole control
- → The name mapping exists only on paper, written by you
GDPR status
- ● Genuinely anonymous to us
- ● We see no names and no contact details — only an ID and time windows
- ● Recommended for professions bound by secrecy — Art. 28 DPA included
no identity is ever entered digitally
- Name: — (never asked)
- Login: printed code + QR
- Availability: Mon/Wed 18–19h
in memory, discarded after
- ID: p7f3a9c2e18b04d6a
- Availability: Mon/Wed 18–19h
- Priority + reliability score
- ✗ No name, no email, no address
you match it up by hand
- Student #42 → your paper list
- → No digital key — the mapping is yours alone
The badges say who can re-identify at each step. For you as the controller the data stays personal data in every setup — GDPR keeps applying to your practice. What this setup changes is who else can re-identify: nobody.
🔐 The only setup where the name never leaves your practice
You print one sheet per student — a short code and a QR code, with no name on it — and hand them out. The system never learns which person received which sheet.
Because no mapping exists in digital form anywhere in the chain, re-identification is technically impossible for us and our sub-processors, not merely contractually forbidden. This is what makes it suitable for psychotherapists and comparable settings.
One honest caveat: for you this data is personal data either way — your paper list is the key to it, so GDPR keeps applying to your practice in full. Copying that list into a spreadsheet does not change the legal position, but it lowers your protection: the key then sits on a device that can be stolen, copied or encrypted.
A second, separate caveat: taking payment via Stripe SEPA Direct Debit is not covered by this. A SEPA mandate legally requires the payer's real name and IBAN, so enabling it identifies that specific client to Stripe for that transaction, even though your calendar data stays anonymous. Stripe is switched off by default under highest privacy mode for exactly this reason, and can only be turned on after a separate, explicit confirmation that you have reviewed and accept that trade-off yourself.
This distinction decides whether GDPR still applies to the data. Most providers blur it; the honest answer differs per setup.
PSEUDONYMOUS
Pseudonymous (Art. 4(5) GDPR)
The name is replaced by an ID, but somebody still holds the key that maps it back — in this case you: in your database or on your paper list, depending on the setup. The data therefore stays personal data and GDPR keeps applying, even though we never see a name. This is the honest label for every setup in which the mapping still exists anywhere — on paper just as much as digitally.
ANONYMOUS
Anonymous (Recital 26 GDPR)
Nobody can ever map the data back to a person — not even you. That state is only reached once the mapping itself is gone, so as long as you need your paper list to know who is coming at 6 pm, your data stays pseudonymous: Recital 26 covers every means, on any medium. What the PDF + QR setup does reach is the strongest position actually available — on our side the mapping never exists at all, so for us and our sub-processors the data is anonymous. Technically, not merely contractually.
SaaS
"Software as a Service" — you install nothing. We host and run the whole solver for you on our infrastructure; you just log in and use it, instead of running the WordPress plugin on your own server.
Before anything leaves your site, each student ID is replaced by a cryptographic pseudonym. The lookup table stays on your own WordPress installation and is never transmitted.
The solver holds the data in memory for the duration of the computation and discards it afterwards. It is never written to a database, and log lines contain only salted hashes, never plaintext.
The dispatcher runs on servers in Germany (Strato); the actual optimization runs on AWS in the eu-central-1 region (Frankfurt). Your data does not leave the EU.
Separately from the computation, we count usage to bill tokens and to enforce the free tier. It receives your licence key, an installation ID derived from your site address, the number of students and a timestamp.
To keep the free tier honest we do keep the list of pseudonymous student IDs for your installation — otherwise the same free allowance could be reused endlessly under new IDs. These are the same nameless pseudonyms as above, and they are deleted when you request erasure.
✗ It never receives student names, email addresses, availability times or schedules.
- Access (Art. 15): export your data from the WordPress admin at any time.
- Rectification (Art. 16): edit student details directly in WordPress.
- Erasure (Art. 17): request full deletion — account, students, tokens and audit logs, including the stored pseudonym list.
- Portability (Art. 20): export schedules as JSON or CSV.
- Withdraw consent (Art. 7): revoke processing consent at any time.
- Data Processing Agreement (Art. 28): available on request — you are the controller, we are the processor.
- Strato AG — hosting of licence server and dispatcher, Germany
- Amazon Web Services EMEA — solver compute, eu-central-1 (Frankfurt), no persistent storage
- ProWebMa — hosting of this website, Germany
- Stripe Payments Europe — payment processing
- Anthropic — automated review and translation of feature-wish submissions; no student or account data
- Google Ireland — sign-in via Google OAuth (optional)
- CleanTalk — anti-spam screening at registration
For providers that may transfer data to the USA we rely on EU Standard Contractual Clauses (Art. 46(2)(c)) or the EU-US Data Privacy Framework, as set out in each provider's own agreement.
Do you use my data to train AI?
No. Student data is never used to train models or for any purpose beyond computing your schedule. We do not share, sell or monetise it.
Who owns the computed schedules?
You do. Once the schedule is returned, you own and control it. We keep no copy.
Do I still need a Data Processing Agreement if I self-host?
Yes. The optimization engine always runs on our infrastructure, so pseudonymous student data reaches us as a processor even when you host WordPress yourself. We provide the agreement on request. With the PDF + QR code setup no names and no contact details reach us at all and we cannot attribute the data to any person — but you stay the controller, so your own obligations and the agreement remain in place.
Can I delete everything?
Yes. An erasure request removes your account, all students, tokens, audit logs and the stored pseudonym list. Invoices are the one exception: German tax law (§ 147 AO) requires us to keep them for ten years.
What about cookies?
Session cookies for your login, plus optional analytics only after you consent. You can revoke consent at any time via the cookie banner.
For any data protection request or question, contact hallo@stundenplan-berechnen.de. We aim to respond within 30 days; complex requests may take up to 90 days under Art. 12(3) GDPR.
Documentation & Legal
Privacy Policy
Our full privacy and data protection statement, including cookies and third-party tools.
Imprint
Contact and business information for stundenplan-berechnen.de.