The data controller within the meaning of the General Data Protection Regulation (
) and other national data protection laws of the member states, as well as other data protection provisions (
), is:
International Bilingual School Munich, a non-profit limited liability company (GmbH)
Represented by the Managing Director:
Rainer Eckerl
Fürstenrieder Straße 267
81377 Munich
Phone: +49-89-411 149-550
Email: contact@ibsm-school.eu
The data protection officer of the data controller can be reached at
:
Email: datenschutz@ibsm-school.eu
Mailing Address:
International Bilingual School Munich gemeinnützige GmbH
Attn: Data Protection Officer
Fürstenrieder Straße 267
81377 Munich
We process the personal data of our website visitors, prospective customers, customers, and job applicants for the following main purposes:
Please refer to the following sections on the individual processing purposes for the specific legal bases, retention periods, recipients, and other required information.
The legal basis is governed by Article 6(1) of the GDPR:
In particular, you have the right to access your data (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), and objection (Art. 21 GDPR).
If processing is based on your consent, you may withdraw your consent at any time with future effect. This does not affect the lawfulness of the processing carried out on the basis of your consent up until the time of withdrawal.
You also have the right to file a complaint with a data protection supervisory authority.
The authority responsible for Bavaria is:
Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
Phone: 0981 180093-0
Email: poststelle@lda.bayern.de
Website:lda.bayern.de
A complete list of all German data protection officers and their contact information can be found at:bfdi.bund.de
The retention period depends on the specific purpose of the processing:
Data may also be stored if required by European or national law (e.g., retention requirements under commercial and tax law pursuant to Sections 147 of the German Fiscal Code (AO) and 257 of the German Commercial Code (HGB)).
Data will also be deleted or blocked when a required retention period expires, unless further storage is necessary for the conclusion or performance of a contract.
As a general rule, your personal data will only be processed to the extent necessary to fulfill our contractual and legal obligations or to protect legitimate interests. It will be disclosed to the following recipients or categories of recipients:
For specific details about individual recipients and their locations, please refer to the respective sections on each type of processing.
The provision of your personal data is not required by law or by contract. However, the provision of certain data is necessary in order to:
If you do not provide this information, we will not be able to provide the corresponding service.
We do not use automated decision-making as defined in Article 22 of the GDPR. Profiling for marketing or analytical purposes is conducted solely on the basis of your consent (Google Analytics) and has no legal effect on you.
Our website incorporates tools from companies based in the United States (specifically Google Analytics, Google Tag Manager, YouTube, and Google Maps). When these tools are active, your personal data may be transferred to the respective companies’ servers in the United States.
Since the adoption of the EU-U.S. Data Privacy Framework (EU Commission Adequacy Decision of July 10, 2023), the United States has generally been considered a safe third country within the meaning of Article 45 of the GDPR, provided that the relevant U.S. recipient is certified under theFramework.
In addition, we use **EU Standard Contractual Clauses** (Art. 46(2)(c) of the GDPR) with the aforementioned providers.
Notwithstanding the adequacy decision, we would like to point out that U.S. authorities (e.g., law enforcement agencies, intelligence agencies) may access personal data under certain circumstances, and your rights as a data subject may be limited in such cases. We have no influence over such government processing activities.
Specific information on data transfers to third countries for each service can be found in the corresponding sections (Google Analytics, YouTube, Google Maps, Microsoft 365).
Our website is hosted by an external service provider (hosting provider). Personal data collected when you visit the website—in particular, IP addresses, contact requests, metadata and communication data, and contract and contact information—is stored on the provider’s servers.
Hosting is carried out to fulfill our contractual obligations to our (potential) customers (Art. 6(1)(b) GDPR) and in our legitimate interest in the secure and efficient provision of our online services (Art. 6(1)(f) GDPR). If consent is requested, processing is based on Article 6(1)(a) of the GDPR in conjunction with Section 25(1) of the TDDDG; consent may be withdrawn at any time.
Host: hosting.de GmbH, Franzstr. 51, 52064 Aachen, Germany
A data processing agreement (Art. 28 of the GDPR) has been concluded with the hosting provider. Server log files are generally deleted after 7 days, unless retention is required for security reasons. No data is transferred to third countries.
Our website uses cookies. Cookies are small text files that are stored on your device to enable certain features or to analyze user behavior.
A distinction is made between technically necessary cookies and cookies used for analytics, statistics, or marketing purposes.
The processing of technically necessary cookies is based on Article 6(1)(f) of the GDPR. We have a legitimate interest in ensuring that our website is provided in a technically error-free and secure manner.
The use of cookies that are not technically necessary is subject exclusively to your consent (Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG). You may revoke or modify your consent at any time via the Borlabs cookie banner.
We use the Borlabs Cookie consent technology provided by Borlabs GmbH, Rübenkamp 32, 22305 Hamburg, to obtain your consent to the storage of certain cookies or the use of certain technologies and to document this in compliance with data protection regulations.
When you visit our website, a Borlabs cookie is stored in your browser. This cookie stores the consents you have given or any revocation of consent. This data is not shared with Borlabs GmbH.
The collected data will be stored until you request its deletion, delete the Borlabs cookie yourself, or the purpose for which it was stored no longer applies. Statutory retention requirements remain unaffected.
This feature is used to obtain the consent required by law for the use of cookies. The legal basis is Article 6(1)(c) of the GDPR.
For more information, visit:de.borlabs.io
If you submit an inquiry to us via a contact form, we will process the personal data you enter in the form (e.g., name, email address, phone number, message content) for the purpose of handling your inquiry and in case of follow-up questions.
Data processing is carried out for the purpose of taking steps prior to entering into a contract or fulfilling a contract with (potential) customers (Art. 6(1)(b) GDPR) as well as in the legitimate interest of efficiently and transparently handling incoming inquiries (Art. 6(1)(f) GDPR); to the extent that consent is requested in the form, processing is additionally based on Article 6(1)(a) of the GDPR; consent that has been given may be withdrawn at any time.
The data will be deleted as soon as your request has been fully processed and there are no legal retention requirements (e.g., under commercial or tax law) that prevent this.
We will only disclose your information to third parties to the extent necessary to process your request or if we are legally required to do so.
If you contact us by email or phone, we will process the personal data collected in this context (e.g., name, contact information, date and time of contact, content of the inquiry) for the purpose of communicating with you and handling your request.
Email correspondence is handled through the Microsoft 365 service; your communication data is stored in Microsoft data centers in Germany or within the EU.
Data processing is carried out for the purpose of entering into or performing a contract (Art. 6(1)(b) GDPR) as well as in the legitimate interest of ensuring effective and secure communication with (potential) customers, business partners, and other contacts (Art. 6(1)(f) GDPR). Microsoft acts as a data processor in this context; a data processing agreement has been entered into in accordance with Article 28 of the GDPR. To the extent that access from the United States is required in individual cases, this is based on an adequacy decision by the European Commission regarding the United States (EU–US Data Privacy Framework, Article 45 of the GDPR).
The data will be deleted as soon as it is no longer necessary for processing your request and there are no statutory retention periods—in particular, retention requirements under commercial or tax law—that prevent its deletion.
This website embeds videos from YouTube. Personal data such as your IP address, the subpage you visited, and, if applicable, other technical usage data are processed by YouTube as soon as a corresponding video is loaded or played. If you are logged in to YouTube or Google, your usage behavior may be associated with your profile. This processing is carried out to provide embedded videos and to present our online content in an appealing manner (Art. 6(1)(f) GDPR); if consent is requested via the consent banner, processing is based on Article 6(1)(a) of the GDPR in conjunction with Section 25(1) of the TDDDG; consent may be revoked at any time.
The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; data may be transferred to the United States based on, among other things, the EU Standard Contractual Clauses and certification under the EU-U.S. Data Privacy Framework (Articles 45 and 46 of the GDPR). For more information, please see Google’s Privacy Policyhereandhere.
We use the Google Maps service to display locations and make it easier to plan routes. When you visit pages that include Google Maps, personal data such as your IP address, the URL of the page you visited, the date and time of access, and, where applicable, location and usage data are transmitted to Google Ireland Limited and processed on servers in the EU and the U.S.
The legal basis is our legitimate interest in presenting our facilities in a user-friendly and easily discoverable manner (Art. 6(1)(f) GDPR); if consent is requested via the consent banner, processing is based on Article 6(1)(a) of the GDPR in conjunction with Section 25(1) of the TDDDG; consent may be withdrawn at any time.
A transfer to the United States cannot be ruled out; such transfers are made on the basis of the EU Standard Contractual Clauses and Google’s certification under the EU-U.S. Data Privacy Framework (Articles 45 and 46 of the GDPR).
You can find more information about Google's privacy policyhere, as well as the SCCshere.
We use the CleverReach service to send out our newsletter. The data provided during registration (e.g., email address, name if applicable, timestamp, and double opt-in confirmation data) is processed on servers operated by CleverReach GmbH & Co. KG and used for sending the newsletter as well as for statistical analysis of newsletter engagement (open and click-through rates).
The legal basis is your consent pursuant to Article 6(1)(a) of the GDPR; you may revoke this consent at any time with future effect, for example, by using the unsubscribe link in the newsletter.
We have a data processing agreement with CleverReach in accordance with Article 28 of the GDPR. The data is generally stored on servers within the EU/EEA. No data is transferred to third countries.
The data will be deleted after you unsubscribe from the newsletter, provided there are no legal retention requirements to the contrary. Double opt-in records are retained for 3 years for verification purposes.
You can find more information about CleverReach's privacy policyhere.
We maintain company profiles on Facebook and Instagram to provide information about our facilities and offerings and to communicate with prospective students, parents, and other users. Both services are provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
When you visit our Facebook or Instagram pages, Meta processes users’ personal data (e.g., IP address, device information, page views, interactions with posts, comments, and messages) and provides us with aggregated statistics on the use of our pages (“Insights”). We are jointly responsible with Meta for this Insights data within the meaning of Article 26 of the GDPR. The relevant agreement (“Page Insights Supplement Regarding the Controller”) and further information on data processing by Meta can be found atfacebook.comand in Meta’s privacy policy, includinghereandhere.
The legal basis for operating these social media accounts and analyzing the insights data is our legitimate interest in maintaining a modern public image, communicating with (potential) parents, providing insights into daily life at our facilities, conducting public relations activities, and attracting new prospective clients (Art. 6(1)(f) GDPR).
Meta may transfer personal data to third countries, in particular the United States. According to Meta, this is done on the basis of an adequacy decision by the European Commission (EU-U.S. Data Privacy Framework, Art. 45 of the GDPR) and, in addition, the EU Standard Contractual Clauses pursuant to Art. 46 of the GDPR. For further details on the nature, scope, and purposes of data processing by Meta, as well as your rights as a data subject and your settings options (e.g., advertising and privacy settings), please refer to Meta’s privacy policy.
You may exercise your rights (e.g., the right to access, erasure, restriction, and objection) both with us and directly with Meta. To the extent that the processing of data falls solely under Meta’s responsibility (in particular when using the platforms independently of our website), we recommend that you contact Meta directly.
We use the "Ally" accessibility plugin from Elementor Ltd., located at 40 Tuval St., Ramat Gan, Israel, to make our website more accessible and improve usability for people with disabilities.
Depending on the plugin’s configuration, technical usage data may be processed (e.g., page views, use of individual accessibility features, browser and device data). This data may be processed on Elementor’s servers; in this regard, Elementor acts as our data processor. The legal basis is our legitimate interest in ensuring that our website is accessible and user-friendly (Art. 6(1)(f) GDPR).
We have a data processing agreement with Elementor in accordance with Article 28 of the GDPR. For more information on data processing by Elementor, please refer to Elementor’s Privacy Policy atelementor.comand Elementor’sData Processing Agreement.
We use the “Weglot” service provided by Weglot SAS, 138, rue Pierre Joigneaux, 92270 Bois-Colombes, France, to make our website available in multiple languages. In this process, the content displayed on our website is transmitted to Weglot, where it is automatically translated and returned in the selected language versions. In this context, Weglot may process technical information (e.g., IP address, pages visited, language used, browser and device data). Weglot also sets cookies or uses local storage to save your language selection (e.g., wglang, wg-translations, wg-slugs).
The legal basis is our legitimate interest in providing a multilingual, user-friendly presentation of our online offering and in reaching additional target groups (Art. 6(1)(f) GDPR); To the extent that Weglot cookies are not technically necessary, their use is based on your consent (Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG).
We have entered into a data processing agreement with Weglot in accordance with Article 28 of the GDPR. For more information on data processing by Weglot, clickhere.
We use the Softgarden applicant tracking system to process online applications. When you use the applicant portal, the personal data you enter (e.g., master data, contact information, application documents, communication content) is processed on the servers of Softgarden e-recruiting GmbH.
Data processing is carried out for the purpose of deciding whether to establish an employment relationship (Art. 6(1)(b) GDPR in conjunction with § 26 BDSG) and, where applicable, based on your consent (Art. 6(1)(a) GDPR), provided that you consent, for example, to your data being stored in the talent pool for a longer period; Consent may be withdrawn at any time.
The retention period is generally (without consent) 6 months after the conclusion of the application process. If consent is given for inclusion in the talent pool, the retention period is up to 24 months after the conclusion of the application process or until consent is revoked.
Upon the establishment of an employment relationship, the document is added to the personnel file and retained in accordance with labor and social security law requirements.
We have a data processing agreement with Softgarden in accordance with Article 28 of the GDPR. Data processing takes place exclusively on servers located in certified data centers in Germany (Frankfurt am Main). No data is transferred to third countries.
For more details, please refer to the privacy policy on theSoftgarden website.
As of: July 2026
