Privacy Policy

This Privacy Policy describes how Babbel, a service of Babbel Group AG (collectively “Babbel ,” “us,” or “we”), processes personal data and other information through Babbel websites, applications, and other online platforms (our “Services”). This Privacy Policy explains what types of information we collect, how we use it, our sharing practices, and your choices.

This privacy policy sets out the following:

• What data we collect and what we do with it
• What technology we use
• Which advertising services we use
• What data protection rights you have and how you can exercise your rights

We encourage you to periodically review this Privacy Policy for the latest information on our privacy practices. We will update this Privacy Policy to reflect any changes to our practices. If we make any material changes, we will notify you in accordance with applicable laws prior to the changes becoming effective.

Who can I contact?

If you have any questions or comments regarding this Privacy Policy, our privacy practices, or if you wish to exercise your individual rights, please contact us using one of the following methods:

Email: privacy@babbel.com

Mail:
Babbel Group AG
Andreasstraße 72
10243 Berlin

Our Data Protection Officer or another data protection relevant contact can be reached at the email provided above.

What are my rights?

You may contact us at any time if you have any questions concerning your data privacy rights or if you wish to exercise any of the following rights afforded to you under the General Data Protection Regulation (2016/679; the “GDPR“). You have the:

• Right to withdraw your consent in accordance with Art. 7 para. 3 GDPR (e.g. you can contact us if you wish to cancel a previously given consent to receive our newsletter)
• Right to access your data in accordance with Art. 15 GDPR (e.g. e.g. the right to be informed whether or not personal data about you is being processed, what personal data is being processed, and the purpose of the processing.
• Right to correct your data in accordance with Art. 16 GDPR (e.g. you can contact us if your e-mail address has changed and you would us to update the details we hold)
• Right to have your data deleted in accordance with Art. 17 GDPR (e.g. you can contact us if you want us to delete certain data that we have stored about you)
• Right to limit data collection in accordance with Art. 18 GDPR (e.g. you can contact us if you only want us to send you absolutely necessary e-mails)
• Right to data portability in accordance with Art. 20 GDPR (e.g. you can contact us to receive your data in a commonly used and machine-readable format if you want to upload it to another website)
• Right to object how your data is handled in accordance with Art. 21 GDPR (e.g. you can contact us if you do not agree us using your data for analytics as described within this privacy policy)
• Right to send complaints to the supervisory authority in accordance with Art. 77 para. 1 lit f GDPR (e.g. you can contact the data protection supervisory authority directly)

If you wish to file a complaint with a national supervisory authority regarding our processing of your personal data, you may do so by contacting your local data protection authority (“local” meaning where you live or work, or where an alleged data breach has occurred).

The relevant authority in Berlin, Germany is:

Berlin Commissioner for Data Protection and Freedom of Information
Friedrichstraße 219, 10969 Berlin

Storage periods and deletion of data

We only store your information for as long as is needed to fulfil our contractual or legal obligations or any other permissible purpose for which we have collected it, including to detect and prevent fraud or security incidents. When the applicable retention period has expired, we take measures to permanently delete the information, aggregate it, or anonymize it.

Visiting our website

If you merely wish to browse our website, we do not collect any personal data, with the exception of the data that your browser sends to us, e.g.:

• Pages and files accessed
• Date and time of access
• Transmitted data volume
• Browser version
• Status messages (i.e. whether the data transfer was successful)
• Information about your device (e.g. browser version, app version, operating system, language settings, device IDs)
• Previously visited pages (if you access our website via a link)
• Online identifiers (e.g. IP address, session IDs, cookies, device identifiers)
• Geographic data (e.g. city, postal code) (transmitted via IP address)

As a safeguard to protect your privacy, we delete or anonymise the IP address according to set deadlines. Therefore, all other data possibly attached to it can no longer be traced back to you. The information we retain is in anonymous form and is only used for statistical purposes to optimise our website. The purpose of temporarily storing this data is to establish a necessary connection between your device and our server as well as ensuring that our website loads effectively. Such data is therefore required to display the website on your screen, to avoid display problems and other technical error messages. The legal basis is our legitimate interest as laid out under Art. 6 para. 1 s. 1 lit f GDPR.

Investor Relations Newsletter

If you are interested in receiving corporate news our company or our products, you can subscribe to our Investor Relations newsletter. You will then receive an email in which you must click on a link to confirm receipt of the newsletter. We store the email address you provided until you unsubscribe from our newsletter. For this purpose, you will find a corresponding link to unsubscribe in every email of our newsletter. The delivery of the newsletter is carried out by a professional service provider.

As a safeguard to protect your privacy , we ask for a so-called "Double-Opt-In" to ensure that the registered email address actually belongs to you. Furthermore, we have entered into a data processing agreement with the assigned service provider. You also have the possibility to unsubscribe from the newsletter at any time and thus delete your email address from the service provider's database. The purpose of the data requested is to send the newsletter to your personal or professional email address in order to fulfil your request for updates about our company or our products. The legal basis is your consent in accordance with the European data protection requirements under Art. 6 para. 1 s. 1 lit a GDPR.

If you register for our Babbel services, we will also send you marketing emails (advertising to existing customers). You can object to receiving these at any time by sending an e-mail to privacy@babbel.com or opting out in the account settings of your Babbel customer account (at http://de.babbel.com/users/settings/edit). There is also a corresponding unsubscribe link in every marketing email. The legal basis for this data processing is Art. 6 para. 1 s. 1 lit. f GDPR, based on our justified interest in advertising our products and services.

We use embedded graphics known as pixels in our newsletter emails to track whether or not an email has been opened and which links in the email have been clicked on in order to optimize our offers. We collect this data in pseudonymous form for general statistical evaluations as well as for the optimisation and further development of our content and customer communication. The data is not linked to your personal data. The legal basis for this is our aforementioned legitimate interest in accordance with Art. 6 para. 1 s. 1 lit. f GDPR. We use our marketing emails to share content that is most relevant to you and to better understand what our users are actually interested in. If you do not want us to analyse your usage behaviour, you can unsubscribe from our marketing emails or deactivate graphics in your email program by default. The data on your interaction with our marketing emails are stored pseudonymously to improve deliverability and to remedy technical defects; they are then eventually completely anonymised.

Cookies

Our website uses cookies in some instances. Cookies are small text files that are usually stored in a folder in your browser. Cookies contain information on your current and previous website visits:

• Name of the website
• Expiration date of the cookie
• Any cookie value

Provided that cookies do not contain a specific expiration date, they are only saved temporarily and automatically deleted as soon as you close your browser or turn off the device. Cookies with expiration data remain saved even after you have closed your browser or turned off your device. These cookies are only removed once they have reached their expiry date or if you manually delete them.

We use the following three types of cookies on our website:

• required cookies (e.g cookies that required to display the website correctly for you and to store certain settings temporarily)
• functional and performance-related cookies (cookies that help us improve our website, e.g. to evaluate technical data from your visit and therefore avoid error messages)
• advertising and analytics cookies (cookies that provide analytics and personalized ads, e.g. you see ads for shoes if you had previously searched for shoes)

You can use your browser settings to configure, block, and delete cookies. If you delete all cookies from our website, you may find that some website features are not displayed properly. You can find helpful information and instructions for common browsers on the website of the German Federal Office for Information Security: https://www.bsi-fuer-buerger.de/BSIFB/DE/Empfehlungen/EinrichtungSoftware/EinrichtungBrowser/Sicherheitsmassnahmen/Cookies/cookies_node.html

Cookies are only activated after you have granted express permission, with the exception of those cookies that are required for the technology to work. You can withdraw this permission at any time. You can find information on how to withdraw permission, as well as additional information, in the cookie configuration options.

YouTube

We use YouTube to integrate videos. YouTube is operated by YouTube LLC with headquarters at 901 Cherry Avenue, San Bruno, CA 94066, USA. YouTube is represented by Google Inc. with headquarters at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. When playing the embedded videos, a connection to the YouTube servers is established and your IP address is transmitted for technical reasons. If you are also logged into your YouTube user account, YouTube will assign information on the videos you have viewed to your personal user account. You can prevent this assignment by logging out of your YouTube account and other Google Platform accounts before using our website.

The security standards of the Google Platform and the associated Google Privacy Policy (http://www.google.com/intl/de-DE/privacy ) apply as protective measures.

The purpose of the data transfer is the integration of YouTube videos on our website, in order for our users to be able to access the displayed videos comfortably without leaving our website. The legal basis is your consent in accordance with Art. 6 Para. 1 a GDPR.

Google Fonts

For the visual improvement of the fonts we use Google Fonts (https://fonts.google.com ) from Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"), a font collection from Google. These fonts are transferred to the storage folder of your browser and activated when you visit this website or other websites. If this is not supported, the text on the web page will only be displayed in a default font. To make this possible, a request is sent to domains such as fonts.googleapis.com or fonts.gstatic.com, which for technical reasons contains your IP address. However, your data will not be merged with other data or traced back to your person.

As a safeguard to protect your privacy, we have assured ourselves that the retrieval of Google's font collection does not merge your data with other Google services, e.g. if you have a Google user account. Information on data protection at Google Fonts confirms this (https://developers.google.com/fonts/faq ). In addition, the security standards of the Google platform and the associated privacy policy of Google (http://www.google.com/privacy ) apply.
The purpose of transmitting the data is the correct display of the fonts in the layout specified by us. The IP address is required to connect to Google's servers to download the font library if it is not already stored on the device. The legal basis is our legitimate interest as laid out under Art. 6 para. 1 s. 1 lit. f GDPR.

Google Analytics

This website uses Google Analytics, a web analysis service provided by Google Inc. (Google). Google Analytics uses cookies, which are text files saved on your computer that make it possible to analyse how you use the website. Since we have activated anonymization of the data, your IP address will be shortened by Google within the European Union Member States or other states party to the agreement regarding the European Economic Area and only then transferred to the USA. The full IP address will only be transferred to a Google server in the USA and shortened there in exceptional cases. Google uses this information on behalf of the operator of this website to evaluate your use of the website, in order to compile reports regarding website activities and in order to perform additional services for the website provider connected to website use and internet use. The IP address transmitted from your browser for use in Google Analytics will not be connected to other data from Google. You can prevent the cookies from being saved by selecting the appropriate setting in your browser software; please note that in this case you may not be able to fully use all features available on the website.

You can find additional information on Google Analytics’ use of data and data protection at https://marketingplatform.google.com/about/analytics/terms/de/ or at https://marketingplatform.google.com/about/ . Babbel only uses Google Analytics in combination with the gat._anonymizeIp(); expansion, so that IP addresses are only recorded in a shortened, i.e. anonymized form.

As a safeguard to protect your privacy, we use the anonymization feature offered by Google as mentioned above, where analytics are not based on you as a person, but only in aggregated form for statistical analyses. In addition, the security standards of the Google platform and its data privacy policy apply (http://www.google.com/privacy). We have also concluded a data protection agreement with Google, which ensures the protection of your data through technical and organizational security measures. The purpose of the use of Google Analytics is to anonymously analyze usage behavior of our websites. The information helps us to improve our services. The legal basis is our legitimate interest as laid out under Art. 6 para. 1 s. 1 lit. f GDPR.

When is your data shared?

Data collected by us will only be passed on if:

• you have given your express consent in accordance with Art. 6 para. 1 s. 1 lit. a GDPR,
• the disclosure pursuant to Art. 6 para. 1 s. 1 lit. f GDPR is necessary for the assertion, exercise or defence of legal claims and there is no reason to assume that you have an overriding interest worthy of protection in not disclosing your data,
• we are legally obliged to pass on the information in accordance with Art. 6 para. 1 s. 1 lit. c GDPR; or
• this is legally permissible and, according to Art. 6 para. 1 S. 1 lit. b GDPR, is necessary for the processing of contractual relationships with you or for the implementation of pre-contractual measures which are carried out at your request.

In addition, information may be passed on in connection with official enquiries, court orders and legal proceedings if this is necessary for legal prosecution or enforcement.

Data security

Babbel takes security precautions to guarantee that your data is protected from loss, alteration, or misuse. Babbel does this with industry standard firewalls that are constantly being updated as well as other security systems. At the same time, the user should be aware that we cannot offer one hundred percent protection from attacks, due to the constant barrage of new viruses and means of attack on internet service’s secure data systems. Babbel will pursue every attack on the data, regardless of who carried it out, under both civil and criminal law, and inform users in the event that their data has been compromised.

Last updated: September 2021