Privacy policy

Who is responsible for your information

This notice covers the public ATPL.app website. The operator is responsible for deciding how personal information is used, also called the data controller. The operator is based in Germany. For privacy questions and requests, emailprivacy@atpl.app.

To confirm before publication: the controller’s legal name and postal address; any required representative or data protection officer; and the effective date of this notice.

When you browse the website

You can read our public content without creating an account. Delivering a page involves technical information such as your IP address, the requested address, the time of the request and information sent by your browser. Hosting and security services may record this information in access or security logs.

To confirm before publication: which hosting and security providers receive this information, the fields they retain, the purposes of their logs and the retention periods. The proposed purpose is to deliver the website and protect it against misuse. Where applicable, the proposed legal basis is our legitimate interest in running a reliable, secure website; this assessment needs confirmation against the deployed service.

When you contact us

You can contact support@atpl.appfor help. If you send us a message, we receive the contact details and information you include. Send only what we need to understand your request. Please do not send passwords, payment-card details or medical records.

The proposed purpose is to answer your enquiry and keep the records needed to resolve it. Depending on the request, the legal basis may be our legitimate interest in responding, steps you request before entering a contract, or a legal obligation.The provider, applicable basis and retention period must be confirmed before publication.

Cookies, browser storage and analytics

The current website configuration does not enable an analytics integration. Its page framework includes browser preferences, such as a stored theme choice. That configuration alone does not establish which cookies or tracking services the deployed hosting environment uses.

To confirm before publication: audit the deployed website’s cookies, browser storage, external requests and hosting analytics. List their purposes and durations here, and provide consent controls before enabling any non-essential storage or tracking that requires consent.

Accounts and payments

Account registration, study access and checkout are disabled for the current marketing launch. This notice does not describe an active paid study service. Before those features open, it must be updated to explain account details, study records, identity services, billing providers and any additional processing that becomes available.

Who receives information

Website delivery and any contact service can involve providers processing information on the operator’s behalf. Their access should be limited to the work they carry out. Disclosure may also be required to meet a legal obligation or respond to a lawful request.

To confirm before publication: the actual recipients or recipient categories, processing locations and any transfers outside the UK or European Economic Area. Where relevant, identify the applicable adequacy decision or other transfer safeguard and how to obtain a copy.

How long information is kept

Retention should be tied to the purpose of each record. Technical logs, enquiries and records kept to meet a legal obligation may need different periods. Information should be deleted or anonymised when it is no longer needed, subject to any lawful requirement to retain it.

To confirm before publication: the periods, or specific criteria used to set them, for hosting and security logs, correspondence and backups. Include any exceptions for a legal obligation or an active dispute.

Your choices and rights

Depending on the law that applies, you may ask to access, correct or delete your personal information, restrict its use or receive a portable copy. You may also object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing.

These rights have conditions and exceptions. We may need enough information to confirm your identity before handling a request. You can also complain to the relevant data protection authority, including an authority in your country where the applicable law allows it.

To confirm before publication: the request-handling process and the relevant German supervisory authority.

Changes to this notice

The published notice will show when it takes effect and when it changes. Any new feature or change in data use must be reflected in the notice, with further information or consent where required.