← Back to homepage

Privacy Policy

Last updated: October 2026

1. Controller

The controller responsible for data processing on this website is:

David Nawee
Nawee
Weicheselstraße 1
30519 Hannover, Germany

E-Mail: david@nawee.net

2. Hosting and Server Log Files

This website is hosted via GitHub Pages. The provider is GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. When you access the website, the hosting provider automatically processes information transmitted by your browser (so-called server log files), including your IP address, date and time of access, the page accessed, browser type, and operating system.

Processing is based on Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable provision of the website without operating our own server. The server is located in the United States. The transfer of your data there is based on the European Commission’s Standard Contractual Clauses (Art. 46(2) GDPR). We do not have access to these log files ourselves. Further information can be found in GitHub’s privacy statement.

3. Cloudflare (DNS and Web Analytics)

We use Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (“Cloudflare”), as our DNS provider, i.e. for resolving our domain name. Only the request for which server address nawee.net belongs to is processed. Your actual visit to the website is not routed through Cloudflare.

We also use Cloudflare Web Analytics to understand how our website is used (e.g. which pages are visited, from which websites visitors arrive, and how fast the pages load). For this, a script from Cloudflare is loaded when you open a page. It transmits the page address, the referring website, information about your browser, operating system and device, page load times and your IP address, from which an approximate country is derived. Cloudflare Web Analytics does not use cookies, does not store anything on your device and does not create user profiles or track you across websites; we only see aggregated statistics.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interests are the reliable availability of our website and improving our content and offers based on anonymous usage statistics. Cloudflare is certified under the EU-U.S. Data Privacy Framework. Further information is available in Cloudflare’s privacy policy at cloudflare.com/privacypolicy.

4. Contact by Email or Telephone

If you contact us by email or telephone, we store and process your information solely for the purpose of handling your inquiry. The legal basis is Art. 6(1) (b) or (f) GDPR. The data is deleted as soon as it is no longer required for this purpose.

Emails to us are received, stored and sent via the email service Zoho Mail provided by Zoho Corporation B.V. (Netherlands). In particular, your name, email address, the content of your message and technical email data are processed. The data is processed in a Zoho data center in the EU. The legal basis is Art. 6(1)(b) GDPR where your message relates to a contract or pre-contractual measures, and otherwise Art. 6(1)(f) GDPR (legitimate interest in reliable email communication).

Ordering Packages via Zoho Forms

We also use Zoho Forms for ordering packages. Zoho processes your name, email address, the chosen package, your confirmations (booking terms, withdrawal information, start of the service before the withdrawal period expires) with their time, and technical data such as your IP address. Payment is processed within the form via Stripe (see section 7). After payment, you receive a confirmation email from Zoho with your personal booking link. The data is processed in a Zoho data center in the EU. The legal basis is Art. 6(1)(b) GDPR (conclusion and performance of the contract) and Art. 6(1)(c) GDPR (documentation and retention obligations).

Business English Test and Communication Check

The Business English Test and the Communication Check run entirely in your browser. Your answers are not sent to us or to third parties; an unfinished test is only stored temporarily in your browser’s session storage (sessionStorage) and deleted when you close the tab.

If you choose to receive your Business English Test result by email, you are forwarded to a form provided by Zoho Forms (Zoho Corporation B.V., Netherlands). Zoho processes your name (optional), your email address, your test result (score, indicative level, results for the four areas, strongest area and focus area) and technical data such as your IP address. We use this data only to send you your result by email. The data is processed in a Zoho data center in the EU. The legal basis is Art. 6(1)(b) GDPR (your request). Entries are deleted after 6 months.

Online Course and Placement Test

The free online course runs in your browser. Your learning progress, your trophies and your test result are stored only locally in your browser (localStorage) and are not sent to us. You can delete this data at any time by clearing the website data in your browser.

The free Communication Course works without an account: your progress is stored locally in your browser (localStorage). Only if you choose to log in to a user account is your progress also saved there (see “User Account”). The same applies to your progress with the picture cards, the reading texts, your best scores in the games and your learning time (counted only while you are active on a learning page). Your answers in the exercises are never saved.

Some lessons let you record your own voice to compare it with the model pronunciation. Your browser only accesses the microphone after you click “Record” and allow access. The recording is kept only temporarily in your browser’s memory so you can play it back; it is not saved and not transmitted to us or anyone else, and it is deleted when you close the page. The spoken example sentences are recordings by David Nawee or, where none exist yet, generated by your browser’s built-in voice on your device.

After your first placement test, we send the determined level (e.g. “B1”) and the page language to our database service Supabase (Supabase Inc., USA; stored in a data center in Frankfurt am Main, EU). No names, email addresses or other identifiers are stored, so the data cannot be linked to you. When the connection is made, Supabase processes your IP address for technical reasons; we do not store it. The purpose is an anonymous statistic on the language level of course participants, to improve the course. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in improving our services). We have a data processing agreement with Supabase in accordance with Art. 28 GDPR; any data transfers to the USA are covered by the European Commission’s Standard Contractual Clauses.

Getting Started Questions

On the “Get started” page you can voluntarily answer a few questions (for example how you heard about Nawee, why you are learning English, how much English you already know and how much time you want to spend) to get a suitable learning plan. Your answers are stored locally in your browser (localStorage). If you have a user account, they are also stored there (see “User Account”).

The first time you finish the questions, we send the selected answers and the language of the page to our database service Supabase (Supabase Inc., USA; stored in a data center in Frankfurt am Main, EU). No names, email addresses or other identifiers are stored; it is not possible to identify you. When the connection is established, Supabase technically processes your IP address; we do not store it. The purpose is an anonymous statistic of what learners want, so we can shape our offer accordingly. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in improving our offer). A data processing agreement pursuant to Art. 28 GDPR is in place with Supabase; any data transfers to the USA are covered by the EU Commission’s Standard Contractual Clauses.

Live Web Seminar

You can sign up for our free live web seminar with your user account. We store that your account is signed up for the web seminar and the time of signing up (at Supabase, see “User Account”). Only signed-up participants see the Zoom link in their account. You can cancel your sign-up at any time yourself; it is also deleted when you delete your account. The legal basis is Art. 6(1)(b) GDPR (taking part in the web seminar you requested).

The web seminar takes place on Zoom (Zoom Communications, Inc., USA). When you join, Zoom processes in particular the name you enter, technical data (e.g. IP address, device) and – only if you use your camera, microphone or the chat – video, audio and chat messages. Camera and microphone are optional. Zoom is certified under the EU-US Data Privacy Framework; a data processing agreement pursuant to Art. 28 GDPR is in place with Zoom. More information: Zoom privacy statement.

User Account

You can voluntarily create a free user account to save your course progress and trophies across devices. We process your email address, your first name (for the greeting), your username, your password (stored only in encrypted form as a so-called hash – we cannot see it), your course progress and trophies, and technical login data (e.g. the time of registration and last login, and your IP address to protect against misuse). The data is stored with our service provider Supabase (Supabase Inc., USA; stored in a data center in Frankfurt am Main, EU). For logging in, a session key is stored in your browser’s storage (localStorage); this is technically necessary for the login.

Emails to confirm your email address and to reset your password are sent via Brevo (Sendinblue SAS, France). The legal basis is Art. 6(1)(b) GDPR (providing the account you requested). You can delete your account yourself at any time on the “My account” page; this deletes your account, profile and saved progress. We have data processing agreements with Supabase and Brevo in accordance with Art. 28 GDPR; any data transfers to the USA are covered by the European Commission’s Standard Contractual Clauses.

Instead of an email address and password, you can also sign in with your Google account (“Continue with Google”). This only happens if you click that button. You are then forwarded to Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), where you log in. Google then sends us your name, your email address and, if available, your profile picture; we use your name or email address to create your username. We do not receive your Google password. Google may also process your data in the USA; Google is certified under the EU-U.S. Data Privacy Framework. The legal basis is Art. 6(1)(b) GDPR (providing the account you requested). More information: Google Privacy Policy.

Online Withdrawal via Zoho Forms

For the electronic withdrawal from contracts (“Withdraw from contract”), we use a form provided by the service Zoho Forms of Zoho Corporation B.V. (Netherlands). The form is loaded on the “Withdraw from contract” and withdrawal information pages. Zoho processes your name, email address, the details of the contract withdrawn from, your withdrawal statement, the time of receipt and technical data such as your IP address. The data is processed in a Zoho data center in the EU.

We use this data to process your withdrawal and to confirm its receipt. The legal basis is Art. 6(1)(c) GDPR in conjunction with § 356a of the German Civil Code (BGB) (statutory obligation to provide an electronic withdrawal function) and Art. 6(1)(b) GDPR. Further information can be found in Zoho’s privacy policy.

We have a data processing agreement with Zoho Corporation B.V. in accordance with Art. 28 GDPR. It covers all Zoho services mentioned in this section (Zoho Mail and Zoho Forms).

5. Newsletter

If you subscribe to our newsletter, we process your email address to send you tips, insights and ideas on English and communication. Registration uses a double opt-in procedure: you first receive an email containing a confirmation link. Only after your confirmation will we add you to the mailing list. We store the date and time of registration and confirmation, as well as your IP address, to demonstrate that consent was obtained.

The legal basis is your consent under Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future, for example via the unsubscribe link in each email or by contacting us at david@nawee.net. The lawfulness of processing carried out before withdrawal remains unaffected.

The newsletter is sent via Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France). We have a data processing agreement with Brevo. The subscription form is part of our own website; no content from Brevo is loaded when you simply visit the page. Only when you click “Subscribe” are your email address and IP address transmitted to Brevo.

6. LinkedIn

This website contains embedded content from LinkedIn, such as LinkedIn posts. LinkedIn is operated by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.

LinkedIn posts are only loaded after you click “Load LinkedIn posts”; before that, no connection to LinkedIn is established. The legal basis is your consent under Art. 6(1)(a) GDPR in conjunction with § 25(1) of the German TDDDG.

When embedded LinkedIn content is loaded, a connection to LinkedIn's servers is established. LinkedIn may receive information such as your IP address, information about your browser and device, and information about the website from which the LinkedIn content is accessed. LinkedIn may also use cookies and similar technologies in connection with embedded content.

If you are logged into your LinkedIn account, LinkedIn may be able to associate your visit with your LinkedIn account. LinkedIn may process information collected through embedded services for purposes including providing the embedded content, security, analytics, and other purposes described in its Privacy Policy.

Where consent is required under § 25 TDDDG, the embedded LinkedIn content will only be loaded after the user's consent.

Further information about how LinkedIn processes personal data can be found in LinkedIn's Privacy Policy . Further information about LinkedIn's use of cookies and similar technologies can be found in its Cookie Policy .

7. Appointment Booking (Cal.com) and Payment (Stripe)

To book appointments (e.g. the free initial consultation), we use the service Cal.com provided by Cal.com, Inc. When you click a booking link, you are redirected to Cal.com's booking page. No Cal.com content is loaded on our website itself.

When you make a booking, Cal.com processes the data you enter, in particular your name, email address, phone number and message where provided, and the appointment you choose. We use this data to hold the appointment and to contact you. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures or performance of a contract).

Booked appointments are automatically transferred to our Google Calendar so that we can manage availability and avoid double bookings. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Your name, email address and appointment details are transmitted to Google. A transfer to the USA is possible; Google is certified under the EU-US Data Privacy Framework. The legal basis is Art. 6(1)(b) GDPR.

Where data is transferred to the USA, this takes place on the basis of appropriate safeguards in accordance with Art. 44 et seq. GDPR. Further information can be found in Cal.com's Privacy Policy .

Payment Processing via Stripe

Packages can be paid online. Payment takes place within the order form (Zoho Forms, see section 4) via the payment service provider Stripe; your payment details are transmitted directly to Stripe. For customers in the EU, the provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland.

Stripe processes in particular your name, email address, payment details (e.g. card details), the amount and technical data such as your IP address. We do not receive your full payment details; we only receive confirmation that the payment has been made. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (statutory retention obligations). For fraud prevention, Stripe also processes data on the basis of legitimate interests (Art. 6(1)(f) GDPR).

Stripe may also transfer data to Stripe, Inc. in the USA. This takes place on the basis of appropriate safeguards in accordance with Art. 44 et seq. GDPR. Further information can be found in Stripe's Privacy Policy .

8. Cookies

We do not use our own cookies on this website for analytics or advertising purposes; our visit statistics (Cloudflare Web Analytics, see Section 3) work without cookies. Third-party services embedded on this website, such as LinkedIn, may use cookies or similar technologies. Please see Section 6 for information about LinkedIn's embedded content.

9. SSL/TLS Encryption

This website uses SSL/TLS encryption for security reasons. You can recognize an encrypted connection by “https://” in your browser’s address bar.

10. Storage Period

We only store personal data for as long as is necessary for the respective purpose:

11. Your Rights

You have the following rights with regard to your personal data:

If you believe that the processing of your data violates data protection law, you may lodge a complaint with a supervisory authority. The supervisory authority responsible for us is the State Commissioner for Data Protection of Lower Saxony (Landesbeauftragte für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hannover, Germany.

If you have any questions about data protection, you can contact us at david@nawee.net.