For providers / Contracts and privacy
Create a privacy notice for your course business
What your own privacy notice should cover, why it supplements courseplanner’s notice, and how to prepare, review and add it.
Development preview: prepared locally, not yet released. General guidance, not individual legal advice.
For providers in Germany. Have your operating procedures and current contractual documents ready.
What is a privacy notice?
A privacy notice explains to the people whose personal data you process who is responsible, which data you use, for what purposes, on what legal basis, and what rights they have. In a course business, this can include booking details, messages about a session, attendance records and billing.
The notice provides information; it is not blanket consent. Writing a notice does not make unlawful processing lawful. Each processing activity needs an appropriate legal basis, and your actual procedures must match your description. Even a free trial session or a small business can involve personal data and information duties.
This guide is for course providers in Germany under the GDPR. It helps you prepare, but is not individual legal advice or a ready-to-use template. Other countries, particular sectors and unusual processing activities need a separate assessment.
Why do you need one in addition to courseplanner’s notice?
courseplanner describes the platform’s own data processing in its privacy notice. You describe the processing for which your business is responsible. The platform cannot know whether you also print lists, send documents to your accountant, run a newsletter or use an external video conferencing service.
If you use your own lists or additional systems alongside courseplanner, describe that processing in your privacy notice too. Include its purpose, who can access the data and how long it is kept.
For agreed administrative activities performed on instructions, courseplanner may act as a processor. The data processing agreement governs that role. This does not mean that courseplanner is only a processor for every activity or takes over your information duties. Check the roles against the current contracts and actual procedures.
| Document | Purpose |
|---|---|
| Your privacy notice | Information about personal data processing for which you are responsible. |
| courseplanner’s privacy notice | Information about the platform’s own data processing. |
| Data processing agreement (DPA / AVV) | Agreement between a controller and a processor; does not replace information to participants. |
| Your course terms | Contractual rules for your services; these do not replace a privacy notice either. |
What should you gather before writing?
Start with your procedures, not a generator. Follow a typical participant journey from the first enquiry to the final invoice, including activities outside courseplanner. A separate website with cookies, analytics or contact forms needs appropriate information too; a reference to course bookings alone does not cover it.
For each activity, record the people concerned, data needed, purpose, legal basis, people with access, service providers, storage locations, deletion point and how you provide information. This working list helps you gather facts; it is not a publication template.
- List enquiries, bookings, attendance, course messages, invoices and, where relevant, complaints.
- Record your own tools, such as email, accounting, printed lists and video conferencing. Include only services you actually use.
- Distinguish people making bookings, actual participants and, where applicable, parents or guardians.
- Check provider documentation, DPAs, subprocessors and possible access from third countries. Do not repeat a blanket claim that everything stays in the EU without checking.
- Decide who handles data rights requests and which reachable contact address you will publish.
What should your privacy notice include?
Use these points as a checklist for GDPR Articles 13 and 14. The information required in your case depends on the processing. Be clear and specific: “We process data in accordance with the GDPR” does not answer participants’ questions.
| Topic | What to explain |
|---|---|
| Controller and contact | Full legal name, reachable contact details and any representative. A brand name alone is insufficient if it does not identify the responsible person or company. |
| Data protection officer | Contact details if an officer has been appointed. A general privacy email address does not automatically identify a formally appointed officer. |
| Purposes and legal bases | Explain what happens and why for each activity. If you rely on legitimate interests, identify the specific interest. Contract, legal obligation and consent are not interchangeable. |
| Data and sources | Explain which data is involved. Where data comes from other sources, include in particular the categories of data and their origin. |
| Recipients | Recipients or categories of recipients, including service providers and other parties actually involved. Their roles must reflect reality. |
| Transfers to third countries | Where intended: the relevant transfers or destinations, applicable safeguards and how information about those safeguards can be obtained. |
| Retention | Specific periods or understandable criteria for each data type. Distinguish short-lived attendance lists from documents subject to statutory retention duties. |
| Rights | Access, rectification, erasure, restriction, portability and objection, subject to the relevant legal conditions; also the right to complain to a supervisory authority. |
| Consent | Where processing relies on it: the ability to withdraw consent for the future without affecting the lawfulness of earlier processing. |
| Required information | Whether data is required by law or contract, whether providing it is obligatory, and the consequences of not providing it. |
| Automated decisions | Where relevant: information on automated decision-making, including profiling, its logic and significance. Do not claim it exists or is absent without checking. |
How do you choose legal bases and retention periods?
Assign a verified legal basis to each purpose. Processing necessary to perform a contract with the person concerned may rely on GDPR Article 6(1)(b); statutory documentation duties may have a different basis. If someone books for another person, that other person is not automatically a contracting party. Do not assume the contractual basis applies to everyone involved.
Consent is not a convenient universal solution. Additional advertising, photos and other optional uses need their own assessment. A booking or publication of your privacy notice does not provide blanket permission. If you rely on legitimate interests, assess the interests and rights of the people concerned too.
Do not promise to delete all data immediately after a course if you must retain invoices. Equally, do not promise unlimited storage. Discuss appropriate periods with your privacy adviser and, for tax records, your tax adviser. courseplanner’s periods cannot simply be applied to your own exports or paper documents.
How do you create a suitable notice?
A good notice describes your particular business and is understandable without legal training. You may use a current starting text suitable for your activities, but you remain responsible for its completeness and accuracy. Do not simply copy another provider’s notice or courseplanner’s.
Generators and AI can help with an outline or draft, but do not reliably know your contracts, tools or procedures. Check a template’s currency, jurisdiction, scope and usage rights. Do not upload participant lists or confidential documents to an arbitrary tool. A generated text is not evidence of legal review.
- Complete your inventory and resolve open questions about service providers and retention.
- Organize the notice by controller, processing activities, recipients, retention and rights. A date or version helps future maintenance.
- Describe each actual activity clearly and briefly. Remove inapplicable template clauses and add missing activities.
- Get professional advice on uncertain legal bases, international transfers, children or special categories of data.
- Compare the text with your technical settings and actual procedures. Wording does not change a system configuration.
- Ask someone unfamiliar with your business to read it. Then check links, the email address, mobile readability and the exported PDF.
How do you add the notice in courseplanner?
courseplanner requires your own privacy notice. During setup and later in provider settings under “Contract and privacy”, enter your full legal company name, business address and public privacy email address. These details are intended for publication. Do not include participant data, passwords or internal notes.
Under “Your privacy notice”, choose text or PDF. Text must contain 100–60,000 characters. A PDF must be no larger than 512 KiB, static and unencrypted, without active content or embedded attachments. An external link alone does not replace the complete text or PDF in this field. Prefer selectable text and a readable structure to scanned images.
You can use headings, bold, italics, underlining, bullet points, numbered lists and links. The character limit applies to visible text. Check formatting in “Preview text”; after saving, it is retained in the published text view.
Review the preview or your PDF. Confirm publication and the accuracy of your details. Missing provider agreements and your authority to represent the business are confirmed separately. “Save” performs the required steps; “Next step” becomes available after full success. The notice alone does not make your provider profile live.
For later changes, you can keep an existing PDF and change accompanying details such as your contact email. A new version requires a fresh publication confirmation. Company name and address covered by an existing agreement cannot be silently rewritten; contact support for review.
The same form contains the required imprint, optional course terms and withdrawal information appropriate to your offers. The privacy notice does not replace those documents. The shared overview of your public Legal documents links the individual provider information and the courseplanner documents.
When and how must people receive the information?
For direct collection, information generally needs to be available when the data is collected. courseplanner provides for showing the notice before booking details are entered. Your own forms, emails and on-site procedures must also meet the requirements; a link somewhere on a website is not sufficient for every situation.
If someone books for another person, you must also ensure that person is informed. Indirect collection falls under GDPR Article 14: generally within a reasonable period, at the latest within one month, or sooner if communication or disclosure occurs earlier. Exceptions need individual assessment; one month is not a blanket grace period.
For children, use age-appropriate language and an appropriate way of informing them, taking guardians’ roles into account. A message only to the person making the booking does not automatically prove everyone concerned was informed. Document how you provide information.
The publication checkbox in the provider form confirms your details. It is not participants’ consent. Additional uses requiring consent need a separate suitable process.
Which mistakes should you avoid?
Avoid a website-cookie-only notice that does not cover bookings and course operations. Also avoid lists of services you do not use, unverified promises about storage locations or retention, and mandatory consent for everything.
Do not publish participant names, individual case descriptions, diagnoses or other confidential data. courseplanner’s provider terms exclude medical or disease-specific offers and requests for health data. A paragraph in your privacy notice does not override that restriction.
Use course messages for the booked course. Your own privacy notice does not authorise unrelated advertising or messages. Assess new processing purposes before introducing them, and update both the information and your actual procedures in time.
An accepted file or successful save confirms technical requirements, not the legal completeness of your text.
Where can you get help?
For a review tailored to your business, consult a lawyer experienced in data protection law. An appointed data protection officer or qualified privacy adviser can help with your inventory, roles, procedures and information duties; agree on the scope of their work.
The German Data Protection Conference links to federal and state supervisory authorities. These provide official guidance and contacts for questions about responsibility. Many private course businesses fall under a state authority; Bavaria has separate authorities for public and private bodies. An authority does not replace an adviser commissioned to draft your documents.
The German Federal Bar (BRAK) provides a register to verify lawyers’ admission and information on finding a lawyer. The register is not a certification of privacy expertise. Ask about experience with course businesses, online bookings and your services.
For questions about the field, PDF format or a saving error, use courseplanner’s support contact route at the bottom of this page. Technical help is not individual legal approval. State the affected step and provide a sanitised error message; do not send participant data.
Checklist before publication
Repeat these checks after every substantial change. Keep the reviewed version for your own records and decide who will maintain the notice.
- The legal name, address and privacy contact are accurate and reachable.
- All actual activities, groups of people and services used are covered.
- Purposes, legal bases, recipients, possible third-country transfers and retention are settled.
- Rights and information routes, including for people registered by others, are explained clearly.
- The text agrees with your settings and contains no confidential data.
- The file is readable and saving succeeded. Resolve open legal questions before relying on the text.
Sources and review date
Research checked on 16 October 2026. The applicable law and your particular circumstances are decisive. The linked DSK Short Paper is dated 16 January 2018 and provides orientation; it is not a current approval of your individual case.
Attribution for the DSK guidance: Conference of the Independent Federal and State Data Protection Supervisory Authorities (Datenschutzkonferenz). Data license Germany – attribution – version 2.0. This page independently adapts the guidance to course providers.