Privacy Policy
In this Privacy Policy, we inform you about what personal data we process when you visit our website www.medientraining-institut.de, for what purposes and on what legal basis this is done, and what rights you have. Effective as of October 2026
1. Data Controller
DIKT GmbH – German Institute for Communication and Media Training®
Widenmayerstr. 9 80538 Munich
Managing Director: Dr. Nikolai A. Behr
Phone: 089 80033450
Email: office[at]medientraining-institut.de
We have not appointed a data protection officer, as the legal requirements for doing so have not been met. If you have any questions regarding data protection, please contact us using the contact information provided above.
2. Overview: Legal Basis for Processing
We process personal data in accordance with the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG), and the Telecommunications and Digital Services Data Protection Act (TDDDG). The following provisions are particularly relevant:
- Consent (Art. 6(1)(a) GDPR; additionally, § 25(1) TDDDG when accessing your device): You have given us your consent for specific purposes.
- Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR): e.g., when you contact us regarding a training session or an offer.
- Legal obligation (Art. 6(1)(c) GDPR): e.g., retention requirements under commercial and tax law.
Legitimate interests (Art. 6(1)(f) GDPR): e.g., the secure and stable operation of our website. Storage on your device that is technically essential is based on § 25(2)(2) TDDDG.
3. Your Rights
Under the GDPR, you have the following rights with respect to us:
- Right to access personal data stored about you (Art. 15 GDPR),
- Right to rectification of inaccurate data (Art. 16 GDPR),
- Right to erasure (Art. 17 GDPR),
- Right to restriction of processing (Art. 18 GDPR),
- Right to data portability (Art. 20 GDPR),
- Right to withdraw consent with future effect (Art. 7(3) GDPR).
Right to Object (Art. 21 GDPR): To the extent that we process data based on legitimate interests, you may object to such processing at any time for reasons arising from your particular situation. You may object to processing for direct marketing purposes at any time without providing a reason. Right to File a Complaint: You have the right to file a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, www.lda.bayern.de. You can change or withdraw your consent to cookies and external services at any time via the “Manage Consent” link on our website.
4. Recipients, Processing on Behalf of a Controller, and Transfers to Third Countries
We use external service providers to operate our website. To the extent that these providers process data on our behalf, we have entered into data processing agreements with them in accordance with Article 28 of the GDPR. Some of the providers listed below are based in the United States or may transfer data there. The European Commission has issued an adequacy decision for the United States (EU-U.S. Data Privacy Framework). Transfers to providers certified under this framework are thereby safeguarded. In all other cases, we base transfers on the European Commission’s Standard Contractual Clauses (Article 46(2)(c) of the GDPR).
5. Retention Period
We store personal data only for as long as is necessary for the respective purpose or as required by statutory retention obligations (typically 6 years for business correspondence and 10 years for accounting-related documents). If consent is revoked or the purpose no longer applies, we delete the data, provided that no statutory retention obligation prevents us from doing so. We specify the exact retention periods for each individual processing activity.
6. Hosting and Server Log Files
Our website is hosted by Mittwald CM Service GmbH & Co. KG, Königsberger Str. 4–6, 32339 Espelkamp, Germany. The data is processed on servers in Germany. We have a contract with the hosting provider for data processing on our behalf. When you visit our website, the following information is automatically stored in server log files: IP address, date and time of access, page or file accessed, amount of data transferred, referrer URL, browser used, and operating system. The purpose is to deliver the website, ensure stability and security, and defend against attacks. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). The log files are deleted or anonymized after 14 days at the latest, unless they are needed to investigate a security incident. Our website uses SSL or TLS encryption. You can recognize an encrypted connection by “https://” in your browser’s address bar.
7. Cookies and Consent Management
We use cookies and similar technologies. We set technically necessary cookies in accordance with Section 25(2)(2) of the TDDDG and Article 6(1)(f) of the GDPR. All other cookies and external services (statistics, marketing, embedded content) are loaded only after you have given your consent via our consent banner (Section 25(1) of the TDDDG, Article 6(1)(a) of the GDPR). We use the WordPress plugin Complianz to manage consent. The plugin runs on our own server; no data is transmitted to the plugin’s developer. Your selections are stored in cookies (e.g., cmplz_banner-status, cmplz_marketing, cmplz_statistics) in your browser for 365 days so that we can honor your decision on your next visit. The legal basis is our legal obligation to document consent (Art. 6(1)(c) in conjunction with Art. 7(1) of the GDPR). You can find an overview of all cookies used in our Cookie Policy. There, and via the “Manage Consent” link, you can change your selections at any time.
8. Making Contact
When you contact us via email, phone, or a contact form, we process your information (e.g., name, email address, phone number, company, content of your inquiry) in order to handle your inquiry. The legal basis is Article 6(1)(b) of the GDPR, insofar as your inquiry relates to a contract or pre-contractual negotiations; otherwise, it is our legitimate interest in responding to inquiries (Article 6(1)(f) of the GDPR). We delete the data as soon as the inquiry has been fully processed and there are no legal retention requirements to the contrary. Registrations for Training Sessions, Seminars, and Events: If you register for a training session, seminar, or event—or place an order—using a form on our website, we process the data provided there (e.g., name, company, contact and billing information, desired date) to process and invoice your registration or order. The legal basis is Article 6(1)(b) of the GDPR. We retain data relevant to invoicing in accordance with the statutory retention periods (Article 6(1)(c) of the GDPR). For registrations via external ticketing platforms (e.g., Eventbrite), the privacy policies of the respective provider also apply. Spam Protection (Cloudflare Turnstile): To protect our forms from misuse and automated requests, we use Cloudflare Turnstile, a service provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. In this process, technical information such as IP address, browser, and device details is transmitted to Cloudflare to verify that the input was made by a human. The legal basis is our legitimate interest in preventing spam and abuse (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-U.S. Data Privacy Framework. Further information: www.cloudflare.com/privacypolicy/ In the process, technical data (e.g., IP address, browser information) is transmitted to MailerLite, and cookies may be set. The forms will therefore only be displayed after you have consented to the “Marketing” category (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Google reCAPTCHA is used in the forms to protect against misuse (see Section 12). For more information: www.mailerlite.com/legal/privacy-policy
9. Newsletter (MailerLite)
On our website, you can subscribe to our newsletters (e.g., “Don’t Be a Boss, Be a Leader”). We use MailerLite, a service provided by UAB “MailerLite,” J. Basanavičiaus 15, LT-03108 Vilnius, Lithuania, to send these newsletters. The data is stored in the EU. We have a data processing agreement in place with MailerLite. Processed data: Email address, as well as (if provided voluntarily) salutation, title, first and last name, company, and your preferred topics; additionally, the time of registration and confirmation, as well as the IP address. Double opt-in: After signing up, you will receive an email asking you to confirm your subscription. This ensures that no one can subscribe using someone else’s email address. The subscription is logged to verify that the process was conducted lawfully. Performance tracking: Our newsletters contain technical elements (e.g., tracking pixels and personalized links) that allow us to determine whether a newsletter has been opened and which links were clicked. This analysis helps us improve our content. The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe from the newsletter at any time, e.g., via the unsubscribe link in every email. Your data will be deleted after you unsubscribe; we may store your email address in a block list to prevent future mailings (Art. 6(1)(f) GDPR). Registration forms on the website: The registration forms and pop-ups are loaded directly from MailerLite’s servers. In the process, technical data (e.g., IP address, browser information) is transmitted to MailerLite, and cookies may be set. The forms will therefore only be displayed after you have consented to the “Marketing” category (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Google reCAPTCHA is used in the forms to protect against misuse (see Section 12). For more information: www.mailerlite.com/legal/privacy-policy
10. Web Analytics with Google Analytics
If you have given your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). It is integrated via the WordPress plugin ExactMetrics. Google Analytics uses cookies (e.g., _ga, _ga_*) to analyze how our website is used—such as which pages are visited, how long visitors stay, and how they found us. Among other things, this involves processing truncated IP addresses, device and browser information, approximate location (country/region), and your usage behavior. IP addresses are not stored by Google Analytics 4 within the EU. The information is aggregated into pseudonymous usage profiles; it is not linked to your name. The purpose is to analyze and improve our online offering. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Data may be transferred to the U.S.; Google LLC is certified under the EU-U.S. Data Privacy Framework. We have a data processing agreement in place with Google. The data is deleted after 14 months. The cookies remain stored in your browser for up to 2 years. You can revoke your consent at any time via “Manage Consent.” Further information: policies.google.com/privacy and support.google.com/analytics/answer/6004245
11. Embedded Videos (YouTube)
We embed videos from the YouTube platform on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The videos are not loaded until you have consented to the “Marketing” category; before that, you will see a placeholder. When the video plays, data such as your IP address, device information, and the page you are viewing are transmitted to YouTube, and YouTube may set cookies. If you are signed in to your Google account, YouTube can associate the playback with your account. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Data may be transferred to the United States; Google LLC is certified under the EU-U.S. Data Privacy Framework. For more information: policies.google.com/privacy
12. Google reCAPTCHA
In our newsletter sign-up forms, we use Google reCAPTCHA, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA verifies whether an entry was made by a human or an automated program. To do this, information such as your IP address, browser and device information, mouse movements, and the duration of your visit is analyzed and transmitted to Google. reCAPTCHA is only loaded in conjunction with the sign-up forms—that is, only after you have given your consent in the “Marketing” category (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Data may be transferred to the United States; Google LLC is certified under the EU-U.S. Data Privacy Framework. For more information, see: policies.google.com/privacy and policies.google.com/terms
13. Certification Seal (ProvenExpert)
On our website, we display a rating seal and customer reviews from the ProvenExpert platform. The provider is Expert Systems AG, Quedlinburger Straße 1, 10589 Berlin, Germany. When the seal is loaded, technical data such as your IP address and browser information is transmitted to ProvenExpert. ProvenExpert’s scripts are loaded only after you have given your consent under the “Marketing” category (Art. 6(1)(a) GDPR, § 25(1) TDDDG). A static seal image can also be loaded from ProvenExpert’s servers without your consent; in this case, your IP address is transmitted. The legal basis for this is our legitimate interest in displaying our customer reviews (Art. 6(1)(f) GDPR). Further information: www.provenexpert.com/de-de/datenschutzbestimmungen/
14. Facebook Posts on Our Website
On certain pages (e.g., “News”), we display posts from our Facebook page. To do this, we use the WordPress plugins “Smash Balloon Facebook Feed” and “Feed Them Social.” The posts are retrieved from our server via Meta’s interface and cached there, so that generally no data about you is transmitted to Meta simply by viewing them. If you click on a post or link, you will be redirected to Facebook; there, the privacy policy of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (www.facebook.com/privacy/policy/) applies. To the extent that images or videos are loaded directly from Meta’s servers, this occurs only after you have given your consent in the “Marketing” category (Art. 6(1)(a) GDPR, § 25(1) TDDDG).
15. Our Social Media Accounts and Links
We maintain accounts on social media platforms, particularly LinkedIn, Instagram, and Facebook. On our website, we provide simple links to these accounts. Simply visiting our website does not result in any data being transmitted to these platforms. Only when you click on a link will you be redirected to the respective provider’s page, at which point that provider’s privacy policy applies:
- LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland – www.linkedin.com/legal/privacy-policy
- Instagram and Facebook: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland – privacycenter.instagram.com/policy and www.facebook.com/privacy/policy/
When you visit our profiles on these networks, the providers process your data for their own purposes, including market research and advertising. We are jointly responsible with the respective provider for processing data in connection with page statistics (“Insights”) (Art. 26 GDPR); the providers make the relevant agreements available (e.g., Meta: www.facebook.com/legal/terms/page_controller_addendum). The most effective way to address inquiries regarding your rights is to contact the respective provider directly. The legal basis for our presence on these platforms is our legitimate interest in communicating with prospective and existing customers (Art. 6(1)(f) GDPR).
16. Podcast-Player (Podigee)
On certain pages (e.g., “Podcast” and “Expert Talk”), we embed episodes of our podcast using the Podigee player. The provider is Podigee GmbH, Revaler Str. 28, 10245 Berlin, Germany. When the player loads, technical data such as your IP address, device and browser information, the page you visited, and your usage behavior (e.g., starting playback) are transmitted to Podigee in order to provide the content and compile usage statistics. The player is not loaded until you have consented to the “Marketing” category (Art. 6(1)(a) GDPR, § 25(1) TDDDG). For more information: www.podigee.com/de/about/privacy/
17. Applications
If you apply for a position with us (e.g., for a position listed under “Open Positions”), we will process your application materials and contact information to conduct the application process. The legal basis for this is Article 6(1)(b) of the GDPR in conjunction with Section 26 of the BDSG. If an employment relationship is not established, we will delete your documents no later than six months after the conclusion of the process, unless you have consented to longer-term storage.
18. Fonts
The fonts used on our website (including Google Fonts) are hosted locally on our server. When you visit the website, no connection is established with Google’s servers.
19. Changes to This Privacy Policy
We will update this Privacy Policy as soon as changes to our website or the services we use make it necessary to do so. The version published on this page is the current one.