Privacy Policy
XTech Academy is a hands-on training academy for biotechnology and life sciences in Heidelberg, Germany. We take the protection of your personal data seriously. This Privacy Policy explains which personal data we process when you visit our website or contact us, why we do so, and which rights you have.
I. Controller
The controller responsible for data processing on this website within the meaning of the EU General Data Protection Regulation (GDPR) is:
XTech Academy – Dr. Maryam Kazemi
c/o BioLabs Heidelberg
Nikola-Tesla-Straße 1
69124 Heidelberg, Germany
Email: hello@xtechacademy.com
Phone: +49 176 61075463
II. Overview: which data we process
Depending on how you use our website, we process the following categories of data:
- Technical access data when you visit the website (e.g. IP address, date and time, page requested, browser and operating system)
- Contact data you send us via a form or email (e.g. name, email address, phone number, your message)
- Registration data for courses (e.g. name, contact details, affiliation, selected program and date, comments)
- Application data if you apply for a position (e.g. CV, qualifications, availability, LinkedIn profile)
- Consent settings that you choose in our cookie banner
We do not sell, rent or trade your personal data.
III. Legal bases
We process personal data on the following legal bases:
- Art. 6(1)(b) GDPR – to answer your requests, process course registrations and carry out application procedures (contract or pre-contractual measures)
- Art. 6(1)(f) GDPR – our legitimate interest in operating a secure, stable website and in answering general enquiries
- Art. 6(1)(a) GDPR and § 25(1) TDDDG – your consent, e.g. for statistics cookies or for loading the map
- Art. 6(1)(c) GDPR – legal obligations, e.g. retention periods under tax and commercial law
IV. Hosting and server log files
Our website is hosted by an external web hosting provider who processes data on our behalf (Art. 28 GDPR). When you visit the website, the server automatically records technical access data in log files (IP address, date and time, page requested, referrer, browser and operating system). This is necessary to deliver the website and to ensure its security (Art. 6(1)(f) GDPR). Log files are deleted after a short period, usually within 14 days, unless they are needed to investigate a security incident.
Fonts and all other resources of this website are hosted on our own server. No data is sent to Google Fonts or similar services.
V. Contact, registration and application forms
When you use our contact form, the course pre-registration form or the application form, the data you enter is sent to us by email so that we can process your request. For this we use the form service FormSubmit (formsubmit.co), which forwards the form content to our mailbox. FormSubmit may process this data on servers outside the European Union and stores submissions for up to 30 days. Please do not send us sensitive data via the forms.
Legal basis is Art. 6(1)(b) GDPR for course registrations and applications, and Art. 6(1)(f) GDPR for general enquiries. To protect our forms against spam, we use a hidden spam trap field, a simple time check and a “I’m not a robot” confirmation. These checks run in your browser; no data is sent to third parties for this purpose.
You can of course also contact us directly by email or phone.
VI. Course registration
If you pre-register for a course, we use your data to contact you with registration and payment information, to organise the course and to issue your certificate. Invoicing data is kept for the statutory retention periods (up to 10 years under German tax and commercial law).
VII. Job applications
If you apply for a position, we process your application data only for the application procedure. If we do not hire you, we delete your documents no later than six months after the end of the procedure, unless you have agreed to a longer storage period (e.g. for future positions). If we work together, your data is transferred to your contractor or personnel file.
VIII. Cookies and local storage
Our website does not set its own tracking cookies. We store only the following technically necessary information in your browser’s local storage (§ 25(2) TDDDG):
- your cookie consent choice (so that the banner is not shown again), and
- the time of your last form submission (spam protection).
Statistics (e.g. Google Analytics) are only loaded if you actively agree in the cookie banner. You can change or withdraw your consent at any time on our Cookie Policy page. Details can be found in our Cookie Policy.
IX. Map on the contact page (OpenStreetMap)
Our contact page can display a map from OpenStreetMap (OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom). The map is only loaded after you click on it. Only then is your IP address transmitted to OpenStreetMap. Legal basis is your consent (Art. 6(1)(a) GDPR). More information: https://osmfoundation.org/wiki/Privacy_Policy.
X. Links to social media
Our website contains simple links to our LinkedIn page. These are normal links – no data is transmitted to LinkedIn until you click on them.
XI. Storage period
We store personal data only as long as necessary for the purposes described above or as required by statutory retention periods. Enquiries are usually deleted once they have been fully answered and no further retention is required.
XII. Your rights
You have the following rights regarding your personal data:
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object to processing based on legitimate interests (Art. 21 GDPR)
- Right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR)
To exercise your rights, simply write to hello@xtechacademy.com.
You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, https://www.baden-wuerttemberg.datenschutz.de.
XIII. Security
We use appropriate technical and organisational measures to protect your data, including encrypted transmission (HTTPS), security headers and access restrictions. Please note that no transmission over the internet can be completely secure.
XIV. Image Credits
All images and visual materials used on this website are either:
– Created or downloaded using our licensed Canva.com account, or
– Officially sourced from the BioLabs Heidelberg website (www.biolabs.io), in accordance with their public media usage policy.
If you have any questions about image usage, please contact us at: hello@xtechacademy.com.
XV. Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes to our website, our services or legal requirements. The current version is always available on this page.
Last updated: October 2026
