Privacy Policy

1. Controller

JB IT Solutions, a brand of JB Nexus
Legal entity: JB Nexus, Inh. Jörg Brose
Wittbräucker Str. 115a
44287 Dortmund, Germany
Email: team@jb-nexus.de

2. Collection and storage of personal data

When you visit our website, the following data is automatically collected:

  • IP address of the requesting device
  • Date and time of access
  • URL of the page accessed
  • Browser and operating system used

When you register, we store your email address, an encrypted password and your learning progress. When you sign in via Google, the profile data provided by Google (email, Google ID) is stored.

3. Cookies

We use technically necessary cookies for authentication (session cookie). These cookies are required for the application to function and are deleted when the browser is closed or after the session expires (7 days).

For cookies and similar technologies that are only loaded after your consent (see the following sections), the legal basis is Art. 6(1)(a) GDPR in conjunction with Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) (storage of information on the end user's terminal equipment or access to information already stored there).

4. Google Analytics

This website uses Google Analytics (GA4), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics is only loaded after you have given consent via the cookie banner. The legal basis is Art. 6(1)(a) GDPR. IP anonymization is enabled — your IP address is shortened within the EU before being transmitted to Google.

Google Ireland Limited is a subsidiary of Google LLC (USA). For the transfer of data to the USA, Google relies on the EU-US Data Privacy Framework (DPF), under which Google LLC is certified. You can withdraw your consent at any time via this website's cookie settings. More information: Google Privacy Policy.

5. Google OAuth

We offer the option to sign in via Google. In doing so, you are redirected to the Google sign-in page. After successful sign-in, we receive access to your email address and your Google profile identifier. No further data is requested.

6. Payment processing

We use the service Stripe (Stripe, Inc.) to process payments. During a purchase, you are redirected to Stripe's secure payment page. We do not store any payment data ourselves (credit card numbers, bank details, etc.). Further information can be found in Stripe's Privacy Policy.

7. AI-generated explanations (EU AI Act)

This website offers an optional AI explanation feature. The generated answers are AI-generated content and are explicitly labelled in the interface as "AI explanation" or "AI assistant" (transparency obligation pursuant to Art. 50 EU AI Act).

Only the text of the respective quiz question and the answer options are transmitted to the services of Anthropic (Claude) and OpenAI for the purpose of generating the explanation. No personal data (e.g. name, email, IP address) is transmitted. The legal basis is Art. 6(1)(b) GDPR (performance of a contract). Both providers are based in the USA; the transfer takes place on the basis of the respective Standard Contractual Clauses and/or the DPF.

8. Your rights

You have the right to:

  • Right of access to your stored data (Art. 15 GDPR)
  • Right to rectification of inaccurate data (Art. 16 GDPR)
  • Right to erasure of your data (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object to processing (Art. 21 GDPR)

You can delete your account and all associated data at any time via the account page. If you have questions, contact us at team@jb-nexus.de.

9. Email communication

We send emails for the following purposes:

  • Registration confirmation and password reset — pure service notifications required to provide the contractually owed service. Legal basis: Art. 6(1)(b) GDPR.
  • Account status notifications (e.g. exhaustion of the free trial quota) — inform you of a direct consequence of using the service and contain no price or product advertising. Legal basis: Art. 6(1)(b) GDPR.
  • Subscription-related notifications (e.g. end of the trial period with a reference to the option to upgrade) — these emails may contain information about our paid offerings. They are sent on the basis of the existing-customer privilege under Section 7(3) of the German Act Against Unfair Competition (UWG) and always contain a clearly visible unsubscribe link. You can object to receiving them at any time — by clicking the unsubscribe link in the email or by emailing team@jb-nexus.de.
  • Occasional tips, updates and offers — only if you have expressly consented during registration. Legal basis: Art. 6(1)(a) GDPR. Consent can be withdrawn at any time (Art. 7(3) GDPR).

Consents given are documented pursuant to Art. 5(2) GDPR. Emails are sent via SMTP (IONOS). If you have questions: team@jb-nexus.de.

10. Google Ads

This website uses Google Ads, an online advertising service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use Google Ads to place advertisements in Google Search. Conversion tracking is only activated after you have given consent (cookie banner). The legal basis is Art. 6(1)(a) GDPR.

When you click one of our ads, Google sets a conversion cookie (valid for 30 days). This allows Google and us to recognize whether a specific action (e.g. registration) occurred after a click on an ad. We only receive aggregated, non-personal evaluations. We have a data processing agreement (DPA) with Google pursuant to Art. 28 GDPR.

For the transfer of data to the USA, Google relies on the EU-US Data Privacy Framework (DPF). You can withdraw your consent at any time via the cookie settings or disable cookies at adssettings.google.com. More information: Google Privacy Policy.

11. Internal quality assurance (Slack)

For quality optimization and error analysis of our services, we use Slack internally (Slack Technologies, LLC, 500 Howard Street, San Francisco, CA 94105, USA — part of the Salesforce group). For certain events — page views, registrations, payment transactions, error and feedback reports — internal notifications are automatically sent to our private Slack workspace, which can only be viewed by us.

The following data may be transmitted in the process: partially anonymized IP address, approximate location (city/region), device type, page accessed, referrer, and, for registered users, the email address. The data is used exclusively for internal error analysis and to improve the user experience and is not passed on to third parties. We have a data processing agreement (DPA) with Slack pursuant to Art. 28 GDPR.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in operational security and quality improvement). For the transfer to the USA, Slack relies on the EU-US Data Privacy Framework (DPF) as well as, additionally, EU Standard Contractual Clauses pursuant to Art. 46 GDPR. More information: Slack Privacy Policy.

12. Google reCAPTCHA

To protect our registration and sign-in forms from automated access (bots, spam registrations, credential stuffing), we use reCAPTCHA v3 provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

reCAPTCHA operates invisibly in the background and analyzes usage behavior to distinguish human from automated access. In doing so, the following data, among other things, is transmitted to and processed by Google: IP address, browser and operating system information, time spent on the page, referrer URL, and mouse, keyboard and scroll movements. reCAPTCHA sets a cookie (_GRECAPTCHA) for this purpose. Analysis begins as soon as you access a page with a sign-in or registration form. The content of your form entries is not analyzed.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our services from abusive automated use and in the security of user accounts.

The recipient is Google Ireland Limited (a subsidiary of Google LLC, USA); for the transfer to the USA, Google relies on the EU-US Data Privacy Framework (DPF). More information: Google Privacy Policy and Terms of Service.

13. Meta: Pixel, Conversions API and customer lists (Facebook/Instagram/Threads)

This website uses the Meta Pixel, a service provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"). The Meta Pixel is only loaded after your consent via the cookie banner. The legal basis is Art. 6(1)(a) GDPR.

With your consent, the Meta Pixel records your page visit (standard event "PageView") and transmits it to Meta. We use this data to measure the effectiveness of our advertising on Facebook, Instagram and Threads, and to re-engage visitors who have already visited our website (retargeting) as well as to build similar audiences (lookalike audiences). The Meta Pixel does not transmit any form entries or other plain-text data (e.g. email addresses) to Meta; for the two separate data flows (Conversions API and customer lists), see below.

Meta Platforms Ireland Limited is a subsidiary of Meta Platforms, Inc. (USA). For data transfers to the USA, Meta relies on the EU-US Data Privacy Framework (DPF), under which Meta Platforms, Inc. is certified. You can withdraw your consent at any time via this website's cookie settings. For more information, see Meta's Privacy Policy.

Meta Conversions API (server-side event reporting)

In addition to the Meta Pixel, we report two events to Meta from our server via the Meta Conversions API: the completion of a registration (event "CompleteRegistration", including registration via Google) and the completion of a purchase (event "Purchase"). For a registration, we transmit the SHA-256 hash of your email address (converted to lower case with whitespace removed; the hash is computed on our systems before transmission), your IP address, your browser identifier (user agent), the address of a page of this website from which the registration was started (for registration via Google, a fixed page address of our application), the time and a randomly generated event ID. For a purchase, we transmit the hash of your email address, the amount paid and the currency, a fixed page address of this website, the time and the event ID, but no IP address and no browser identifier. The event ID is the same one the Meta Pixel uses for the same event, so that Meta counts an event reported twice only once. This reporting runs from our server, sets no cookies on your device and is not linked to your cookie settings.

The purpose is to measure whether our ads on Facebook, Instagram and Threads lead to registrations and purchases, and to manage these ads on that basis (conversion measurement); server-side reporting also captures events that the pixel does not transmit (e.g. due to browser settings or ad blockers). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is measuring the success of and economically managing our own advertising. You may object to this processing at any time (Art. 21 GDPR, see the right to object below). For the transfer to the USA, the above regarding the DPF applies.

Customer lists at Meta (custom audiences from hashed email addresses)

Separately from the Meta Pixel, we transmit the email addresses of registered users of this website to Meta Platforms Ireland Limited in pseudonymised form in order to create a so-called custom audience (customer list) there. For this website, we maintain one list: the users who have created a free account but have not purchased anything. Only a SHA-256 hash of the respective email address is transmitted (after conversion to lower case and removal of whitespace); the hash is computed on our systems before transmission. No further data (e.g. name, address, learning progress, payment data) is transmitted. Meta matches the hashes against the hashes of its own user accounts; according to Meta, the uploaded hashes are deleted once the matching process is complete and are not shared with third parties or other advertisers.

The purpose is direct marketing for our own offers on Facebook, Instagram and Threads. The list may be used to show ads specifically to registered users, to exclude them from ads aimed at new users, or as the basis for similar audiences (lookalike audiences) built by Meta. The list is not used for any other purpose.

The legal basis is Art. 6(1)(f) GDPR: "processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child". Our legitimate interest is direct marketing for our own offers to persons who have registered with us; according to Recital 47 GDPR, "the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest". To safeguard your interests, we do not transmit any plain-text data, only the hash of the email address.

Right to object: Under Art. 21(2) GDPR you have the right to object at any time to processing of personal data concerning you for such direct marketing, which includes profiling to the extent that it is related to such direct marketing. To object, an informal email to team@jb-nexus.de stating the email address registered with us is sufficient. Where you object, your personal data shall no longer be processed for such purposes (Art. 21(3) GDPR). The list remains stored at Meta until we delete it; we can delete it at any time using the tools of our Meta advertising account.

Sie können der Nutzung Ihrer E-Mail-Adresse für Werbung und der Übermittlung an Meta jederzeit widersprechen. Schreiben Sie dafür an team@jb-nexus.de. Nach einem Widerspruch oder nach der Löschung Ihres Kontos nehmen wir diese Adresse aus unseren Meta-Zielgruppen. Anzeigen, die Meta schon ausgeliefert hat, können wir nicht zurückholen.

For the transfer of this data to the USA, the above applies: Meta relies on the EU-US Data Privacy Framework (DPF), under which Meta Platforms, Inc. is certified. For more information, see Meta's Custom Audience Terms.

14. Piwik PRO (Web Analytics)

This website uses Piwik PRO, a web analytics service provided by the Piwik PRO group (Piwik PRO S.A., ul. Św. Antoniego 2/4, 50-073 Wrocław, Poland; Piwik PRO GmbH, Kurfürstendamm 21, 10719 Berlin, Germany). Piwik PRO is only loaded after your consent via the cookie banner. The legal basis is Art. 6(1)(a) GDPR.

With your consent, Piwik PRO records your page visit and your scrolling and usage behavior on this website in order to statistically evaluate usage (e.g. visitor numbers, time on page, pages viewed). The Piwik PRO instance we use runs exclusively in data centers within the EU (Piwik PRO offers EU hosting in, among others, Germany, France, Sweden and the Netherlands); your data is not transferred to third countries outside the EU.

Your consent decision is passed on to Piwik PRO's own consent interface (Piwik PRO Consent Manager), which is coupled to this website's cookie banner; Piwik PRO's own, separate consent banner is not displayed. You can withdraw your consent at any time via this website's cookie settings. For more information, see Piwik PRO's Privacy Policy.

Behavior after withdrawal: If you withdraw your consent via the cookie settings of this website, the program components (scripts) of Piwik PRO that were already loaded into your browser at that time are not terminated technically for the remainder of the current page visit. However, as of the withdrawal, no further analytics cookies will be set; previously set analytics cookies (_pk_id, _pk_ses and comparable identifiers) are deleted. The only cookie retained is the consent marker ppms_privacy_<container ID>, which documents your decision and technically ensures that no new analytics cookies are set. From the time of withdrawal onwards, Piwik PRO continues to transmit technical signals regarding the consent status as well as subsequent events (e.g. scrolling actions) to the Piwik PRO instance; the signal regarding the withdrawal still carries the visitor identifier valid up to that point, whereas subsequent events carry no visitor identifier. Neither the withdrawal signal nor subsequent events cause Piwik PRO to set a new cookie. Due to technical reasons, these transmissions contain the accessed URL, the page title, an identifier of the current page view, and your IP address. A re-loading of Piwik PRO on future page views will not occur after a withdrawal.

15. Bing/Microsoft Advertising (UET)

This website uses the Universal Event Tag (UET) of Microsoft Advertising (Bing Ads), an online advertising service provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. We use Microsoft Advertising to place advertisements in Bing Search. The UET tag is only activated after you have given consent via the cookie banner. The legal basis is Art. 6(1)(a) GDPR.

With your consent, Microsoft sets a cookie that allows it to recognize whether a specific action (e.g. registration) occurred on our website after a click on one of our Bing ads (conversion tracking). The transfer is technically carried out via the UET tag and is controlled via Microsoft Advertising's own consent-mode interface: it only takes place if you have consented via the cookie banner; without consent, no cookie is set.

Microsoft Ireland Operations Limited is a subsidiary of Microsoft Corporation (USA). For the transfer of data to the USA, Microsoft relies on the EU-US Data Privacy Framework (DPF), under which Microsoft Corporation is certified. You can withdraw your consent at any time via this website's cookie settings. For more information, see Microsoft's Privacy Policy.

16. Forum: user posts

Registered users can write posts (title and text) and replies in the forum and report individual posts. In doing so, we store the text of the post, the time, the link to your user account (internal user ID), optionally the reference to a practice question or a chapter and, in the case of a report, your reasoning.

Purpose and legal basis: Provision of the forum as part of the user agreement (Art. 6(1)(b) GDPR). The review before publication, the handling of reports and the limitation of the number of posts per account per hour serve the secure operation of the service and the prevention of abuse (Art. 6(1)(f) GDPR); the handling of reports of unlawful content also serves to fulfil our obligations under Article 16 of Regulation (EU) 2022/2065 (Digital Services Act, Art. 6(1)(c) GDPR).

Visibility: Posts are only published after review by us. Published posts are visible to all logged-in users of this platform; the text and time as well as the role of the author (user, editorial team) are displayed, not your name or your email address. The forum pages are blocked for search engines (noindex) and cannot be accessed without logging in.

Internal forwarding: When posts are waiting for approval, our team receives a collective email (at most one per hour) with the title and time of the entries. When a post is reported, our team receives an email with the reported post, your reasoning and your email address, so that we can ask follow-up questions and inform you of the outcome; you receive an acknowledgement of receipt by email.

Retention and deletion: Posts and reports remain stored for as long as the forum is operated. When your account is finally deleted (no later than 90 days after your deletion request, or after the end of a running subscription), the link between your posts and your account is removed; the text of the post is retained without attribution so that discussions remain readable. You can request the deletion of individual posts at any time (Art. 17 GDPR) by email to team@jb-nexus.de. The counters for the post limit (user ID, time window, number) are deleted after 24 hours at the latest.