1. Who is responsible
The controller for your data is Berlin Sports BSC GmbH, Motzstraße 89, 10779 Berlin, Germany. Golpath Institute is one of our brands. For anything about your data, email hello@golpath.com. Full company details are in our Impressum.
2. Visiting our website
When you open a page, our hosting provider automatically processes technical data: your IP address, the date and time, the page requested, your browser and operating system, and the referring website. We need this to deliver the website and keep it secure (Art. 6(1)(f) GDPR). This data is kept in server logs for a short period and not used to identify you.
Our fonts are stored on our own server, so no data is sent to font providers. If you arrive through a link with campaign tags (for example from an ad), we read those tags from the page address and send them with any form you submit, so we know which campaign brought you. Nothing is stored on your device for this.
3. Forms on our website
Request a call and Contact. We collect your name, email address, phone number (optional), the programme you're interested in and your message. We use this to answer you and arrange your call (Art. 6(1)(b) GDPR).
Booking form. We collect your name, email address, phone number, date of birth, nationality, address and country, whether you need a visa, your English level, your education and field of study, how you heard about us, your payment option and whether you'd like help with accommodation. We need this to process your booking, issue your invoice and prepare your visa invitation letter if you need one (Art. 6(1)(b) GDPR).
After payment. We ask for your CV, your motivation and goals, and anything else we should know. This helps us prepare the programme and introduce you to the right people (Art. 6(1)(b) GDPR). If you tell us about dietary requirements or accessibility needs, this may include health information. We only use it to meet your needs during the programme, based on your consent (Art. 9(2)(a) GDPR), which you can withdraw at any time.
4. Email updates
If you sign up for updates, or tick the box in one of our forms, we send you programme dates, offers and news by email. We use a double opt-in: you only receive emails after confirming your address through the link we send you. We record when you signed up and confirmed, to be able to prove your consent. The legal basis is your consent (Art. 6(1)(a) GDPR).
Our emails measure whether they are opened and which links are clicked, so we can improve them. You can unsubscribe at any time using the link in every email, or by writing to us. This also ends the measurement.
5. Payments
Payments are processed by Stripe. When you pay, you enter your payment details directly on Stripe's secure page. We don't see or store your card details. We receive your name, email address, billing address, the amount and the payment status (Art. 6(1)(b) GDPR).
6. Booking a call
After you submit the Request a call form, a Calendly booking calendar loads on the page, with your name and email filled in, so you can choose a time. The calendar only loads at this step, once you've asked to book a call. Calendly may set cookies needed for the booking to work (Art. 6(1)(b) GDPR).
7. Services we use
We use the following service providers, who process data on our behalf under data processing agreements:
- Netlify, Inc. (USA): website hosting and storage of form submissions.
- Brevo (Sendinblue SAS) (France): email lists and sending emails.
- Stripe Payments Europe, Ltd. (Ireland): payment processing. Stripe is also responsible for some processing in its own right, for example fraud prevention and legal obligations.
- Calendly LLC (USA): booking calls.
- Make (Celonis) (EU): passing booking and payment details between our tools, for example to send your booking confirmation.
Where data is transferred to the USA, this is based on the EU-US Data Privacy Framework, where the provider is certified, or on the European Commission's standard contractual clauses.
8. Cookies
Our website does not use cookies for analytics or advertising. The only cookies are those set by Calendly when you open the booking calendar (see section 6), and by Stripe on its payment page. If we add analytics in the future, we will ask for your consent first and update this policy.
9. Photos during the programme
We take photos and videos during the programme. We ask for your consent to use them when you arrive in Lisbon, and you can withdraw it at any time for the future.
10. How long we keep your data
- Enquiries (Request a call, Contact): up to 2 years after our last contact, unless you book.
- Booking and participant data, including your CV: for the duration of the programme and up to 3 years after it ends, so we can stay in touch as part of our alumni network. You can ask us to delete it sooner.
- Invoices and payment records: for the period required by German commercial and tax law (up to 10 years).
- Email updates: until you unsubscribe.
11. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interests. Where processing is based on consent, you can withdraw it at any time, without affecting what happened before. To use any of these rights, email hello@golpath.com.
You also have the right to complain to a data protection authority. Ours is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59-61, 10555 Berlin.
12. Do you have to provide your data?
You don't have to give us any data to browse the website. To book a programme, we need the details marked as required in the booking form. Without them, we can't process your booking.
13. Changes to this policy
We update this policy when our website or the services we use change. The current version is always on this page.