Privacy Policy What we keep, and for how long.
This policy explains what German LifeBox collects when you use this website, why, and what you can do about it. It is written to be read, not skimmed past.
Last updated: 10 October 2026
- No user accounts
- No cookies, ads, tracking or analytics
- Nothing sent to Google or Tally until you click
- Never sold, never marketing emails
- GDPR applies wherever you live
- 12 months for enquiries · 8–10 years for payment records
- 1 month at most to answer a data request, usually 3 days
This page describes how German LifeBox actually operates. It is not legal advice, and it has not been reviewed by a lawyer.
1. Who we are
The controller responsible for your information under the GDPR is Bibin Johnson, who runs German LifeBox as an individual ("German LifeBox", "we", "us"), Auf der Schanz 47, 85049 Ingolstadt, Germany. For anything in this policy you can reach us at hello.glb@gmail.com. We are not required to appoint a data protection officer and have not done so.
German LifeBox helps students in India prepare to study, train and live in Germany. We publish free guides, checklists and tools on this website. Nothing is sold on this site. Our two paid services, 1-1 counselling and the Speaking Club, are currently paused: no new bookings are taken. If you booked one before the pause, this policy still covers the details from that booking.
2. What we collect
We do not run user accounts, and you can read every free guide on this site without giving us anything. We collect personal information only in these situations:
- When you visit the site. Our host, GitHub, logs your IP address when you load a page, together with ordinary request data such as the time, the page requested and your browser type. GitHub keeps these logs for security; we do not see them, and they are never used to build a profile of you.
- When you email us. We receive your email address, your name if you give it, and whatever you write.
- When you send feedback. The “How can I improve?” form on our home page is hosted by Tally. Nothing is sent to Tally until you click that link; the form then receives your IP address and whatever you type into it.
- When you load today's exchange rate. The cost calculator starts with a stored rate. Only if you press “Load today's rate” does your browser ask ExchangeRate-API for the current rate, which shares your IP address with them.
- If you booked a paid service before the pause. The Razorpay booking page asked for your name, email address and phone number, and processed your payment. Razorpay shared those details and the payment record (amount, date, reference) with us, but never your card, UPI or bank details. For counselling, you chose a slot on Calendly (name, email and chosen time). For the Speaking Club, you filled in a short Google Form with your details; sessions are held on Discord, where we see your Discord profile and what you share in the sessions.
Video thumbnails on this site are stored on our own server. Google (YouTube) only receives your data if you click through to a video, and from then on under YouTube's own policy.
3. Why we use it
- To deliver the website securely.
- To answer your email or feedback.
- To show today's exchange rate when you ask for it.
- To deliver a session booked before the pause: scheduling it, sending you the joining details, and following up.
- To keep records of payments as required for accounting and tax.
We do not sell your personal information. We do not run advertising or analytics on this site, and we do not share your details with advertisers. We never send marketing emails: if you have not booked a session or written to us, you will not hear from us.
The legal basis for each purpose
Under Article 6(1) GDPR we must tell you which legal basis applies to each thing we do with your information.
| What we do | Legal basis |
|---|---|
| Deliver the website and keep it secure (server logs) | Article 6(1)(f) — our legitimate interest in running a stable, secure website |
| Answer an email or feedback from someone who has not booked anything | Article 6(1)(f) — our legitimate interest in replying to people who write to us |
| Load today's exchange rate when you press the button | Article 6(1)(f) — our legitimate interest in providing the feature you asked for |
| Deliver a session booked before the pause | Article 6(1)(b) — performing our contract with you |
| Keep records of payments | Article 6(1)(c) — a legal obligation under German tax law |
Giving us your details is never a statutory requirement. It is simply necessary to get an answer, or to receive a session you booked — without them we cannot reply or deliver.
4. Third-party services
This site relies on the following providers. Each has its own privacy policy, and your data is handled under their terms once it reaches them. The services marked “before the pause” are only used for bookings made before paid services were paused.
| Service | Used for | What it may receive |
|---|---|---|
| GitHub | Website hosting | IP address, request logs |
| Tally | The feedback form on our home page, only once you open it | IP address; whatever you type into the form |
| ExchangeRate-API | Today's euro-to-rupee rate, only when you press “Load today's rate” | IP address |
| YouTube (Google) | Videos you choose to open on YouTube | On YouTube itself: IP address, device and viewing data |
| WhatsApp (Meta) | The community group you choose to join | Your profile on that platform |
| Razorpay | Payment pages for counselling and the Speaking Club (before the pause) | Name, email, phone, payment details |
| Calendly | Choosing your counselling slot (before the pause) | Name, email, chosen time |
| Google Forms | The Speaking Club details form (before the pause) | Whatever you type into the form |
| Discord | Speaking Club sessions for existing members | Your Discord profile and what you share in sessions |
Some of the links on our Essentials page are affiliate or referral links. If you click one and sign up, that company may pay German LifeBox a commission, and it will know you arrived from us. This never changes what you pay, and it does not give us access to your account with them. The Essentials page states this on the page itself.
5. Data outside the EU
Some of these providers are based, or store data, outside the European Union. The GDPR (Articles 44–49) only allows that where your information stays protected. This is where each transfer goes and what protects it:
| Provider | Where | Protection |
|---|---|---|
| Tally (Tally BV) | Belgium; form data stored in the EU | Stays in the EU |
| WhatsApp (WhatsApp Ireland Ltd) | Ireland | Provided to EU users from the EU |
| GitHub (GitHub, Inc.) | USA | Certified under the EU-U.S. Data Privacy Framework, which the European Commission has found to provide adequate protection (Article 45) |
| Google (Google LLC) — YouTube, Google Forms | USA | Certified under the EU-U.S. Data Privacy Framework (Article 45) |
| Calendly (Calendly, LLC) | USA | Certified under the EU-U.S. Data Privacy Framework (Article 45) |
| Discord (Discord Netherlands BV, Discord Inc.) | Netherlands and USA | Certified under the EU-U.S. Data Privacy Framework (Article 45) |
| Razorpay (Razorpay Software Pvt. Ltd.) | India | India has no EU adequacy decision. Your details went to Razorpay because that was necessary to pay for the session you booked with us (Article 49(1)(b)) |
| ExchangeRate-API (AYR Tech (Pty) Ltd) | South Africa; servers in Ireland, South Africa and Germany | South Africa has no EU adequacy decision, so EU-level protection cannot be guaranteed there. That is why the calculator never contacts it on its own: only you can, with the button, and the calculator works fully without it |
6. Cookies and browser storage
German LifeBox sets no cookies, and no advertising, tracking or analytics tools of any kind. We do use your browser's local storage to remember a few things on your device. This data never leaves your browser and is not visible to us:
glb-eur-inr— today's euro-to-rupee rate after you have loaded it, so it is not fetched again for six hours.glb-calc-v1— the figures you typed into the cost calculator, so they are still there when you come back. Use “Reset to defaults” to clear them.glb-*-checklist— which items you have ticked on our interactive checklists.glb-timeline-planner,glb-departure-date,glb-movein-date— the dates and choices you enter in the Timeline Planner, the Pre-Departure checklist and the First Week checklist.glb-uni-board,glb-ausbildung-roadmap-sheets,glb-profession-finder-scores— your university shortlist board, the shortlist and tracker sheets on the Ausbildung Roadmap, and your comparison scores in the Profession Finder.
Each of these is strictly necessary to provide a feature you are using, so under § 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) it needs no consent, and we show no cookie banner. You can clear all of it at any time through your browser settings. Nothing on the site breaks if you do; you will simply see default settings and an empty checklist.
Once you open the Tally form, Tally may set its own cookies under its policy. YouTube, Razorpay, Calendly and Google Forms do the same on their own sites.
7. How long we keep it
Enquiries and form responses are kept for as long as needed to deal with them and for a reasonable period afterwards, currently 12 months.
Records connected to a payment are kept for as long as German tax law requires (§ 147 AO): eight years for invoices and payment receipts, and ten years for the accounting records built from them. Each period runs from the end of the year the record was made. We cannot delete those records earlier, even if you ask, but we use them for nothing else.
Everything else you can ask us to delete sooner — see below.
8. Your rights
German LifeBox is operated from Germany, so the GDPR applies to everything we do with your information — wherever in the world you live. You have all of the following rights, and they are the same whether you are in Chennai, Cologne or anywhere else.
- Access — ask what we hold about you (Article 15)
- Rectification — have anything wrong corrected (Article 16)
- Erasure — ask us to delete it (Article 17)
- Restriction — ask us to stop using it while something is disputed (Article 18)
- Portability — get a copy in a portable format (Article 20)
- Objection — see the box below (Article 21)
- Withdraw consent — at any time, without giving a reason, where we relied on your consent. Withdrawing does not undo anything done before you withdrew (Article 7(3))
- Complain to a supervisory authority (Article 77)
Where we use your information on the basis of our legitimate interest (Article 6(1)(f)), you may object at any time, on grounds relating to your particular situation. We will then stop, unless we can show compelling legitimate grounds that override your interests, or need the information to establish, exercise or defend legal claims. An email to hello.glb@gmail.com is enough.
The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany. You may also complain to the authority where you live or work.
If you are in India, the Digital Personal Data Protection Act, 2023 gives you broadly similar rights. Where the two overlap, we apply whichever is better for you.
We do not make any automated decisions about you and we do not profile you.
Write to hello.glb@gmail.com. We answer without undue delay and within one month at the latest, as the GDPR requires (Article 12(3)); in practice usually within 3 working days. We may need to confirm your identity before acting on a request.
9. Children
This site is intended for people aged 18 and over. We do not knowingly collect information from children. If you believe a child has sent us personal information, contact us and we will delete it.
10. Changes to this policy
If we change how we handle your information, we will update this page and the date at the top. Material changes will be noted on the page itself. We will update this policy before paid services reopen.
11. Contact
Questions about this policy, or about your data: hello.glb@gmail.com. Our full contact details are on the Contact page and in the Impressum.