Privacy Policy
How the ESK Pupils' Committee handles your data.
1. Controller
The controller for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is: Pupils' Committee of the European School Karlsruhe (ESK PC) represented by Matteo Greiner (President of the PC) c/o Europäische Schule Karlsruhe Albert-Schweitzer-Straße 1 76139 Karlsruhe Germany Email: [email protected]
2. Data protection officer
No data protection officer has been appointed. For data protection questions, contact us at the email address above.
3. Overview
We process as little personal data as possible. This website serves purely organisational purposes. It uses no analytics or tracking tools, no advertising and no embedded third-party content (such as videos, maps or social media plugins).
4. Technical operation and hosting
Technical operation and hosting of this website are provided on our behalf by: Conseil Supérieur des Élèves (CoSup) Wilhelmstr. 62 75323 Bad Wildbad Germany cosup.eu
We use the hosting services of netcup GmbH (Daimlerstraße 25, 76185 Karlsruhe, Germany) to host and display our website. netcup acts on the basis of processing on our behalf. All data collected on this website is processed on netcup's servers.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and working operation of the website.
5. Server log files
Each time you access the website, the server automatically processes data that your browser transmits: IP address, date and time of access, page or file requested, status code, amount of data transferred, browser type and operating system, and the previously visited page (referrer). This also applies to requests to the database server (section 7).
We need this data to deliver the website securely and reliably and to fend off attacks. It is not analysed for any other purpose and not combined with other data. Log files are deleted after 14 days.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and working operation of the website.
6. Cloudflare
We use the content delivery network and security services of Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA). All requests to this website and to the database server are routed through Cloudflare's servers. In doing so, Cloudflare processes in particular your IP address, the date and time, and technical information about your browser and the request, in order to deliver the website quickly and securely and to block abusive access. Cloudflare acts as our processor.
Data may be transferred to the USA in this context. Cloudflare is certified under the EU-U.S. Data Privacy Framework; the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR). In case that decision ceases to apply, the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR) have additionally been agreed. More information: www.cloudflare.com/privacypolicy/
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and working operation of the website.
7. Database (PocketBase)
Posts, team profiles, transparency documents, absence lists, submitted ideas and staff accounts are stored in a database (PocketBase). It runs at esk-pb.cosup.eu on the netcup server named in section 4. When loading pages and images, your browser fetches some data directly from this server, which transmits your IP address (sections 5 and 6).
8. Ideas form
You can send us suggestions through the “Your Ideas” form. Only a title and a description are required. Your name and email address are optional; without a name, your idea is stored as “Anonymous”.
The data is stored in the database (section 7). Only logged-in PC members who handle your idea, and reply to you if needed, have access to it. Submitted ideas are deleted no later than 12 months after they are received.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is answering requests and ideas.
9. Contact by email
If you write to us at [email protected], we process your email address, your name (if provided) and the content of your message in order to deal with your request. We delete the message once your request has been dealt with.
The mailbox is run on Gmail, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Data may be transferred to Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) in this context. Google LLC is certified under the EU-U.S. Data Privacy Framework; the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR). More information: policies.google.com/privacy
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is answering requests and ideas.
10. Staff login and absence lists
PC members and authorised teachers can log in to the internal area. For this, we store your email address, password (only as a secure hash) and role in the database (section 7). After you log in, a login token is stored in your browser's local storage (localStorage) and in a cookie (see the Cookie Policy). An account is deleted as soon as the person no longer needs access, for example at the end of their term of office.
Teachers can upload absence lists there as Word files. The file is only read and is not stored. Only the class, lesson period, status and, where applicable, the room are stored, so no names. The entries are removed automatically once the day in question has ended.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is running the website and the PC's work.
11. Published content
On this website we publish posts, where applicable with the author's name. The legal basis for this is Art. 6(1)(f) GDPR. Our legitimate interest is transparency about which PC member is responsible for a post.
On the “Meet the Team” page we show the names, roles and photos of PC members. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by emailing [email protected]; we will then remove your photo and name. This does not affect the lawfulness of publication before the withdrawal.
12. Cookies and local storage
We only store what is needed to run the website or to remember your settings (language, light/dark mode, login). See our Cookie Policy for details.
13. Fonts
The fonts used (Inter, Archivo) are served from our own server. No connection is made to servers of Google or any other font provider.
14. External links and Instagram
Our website links to external services such as Instagram or websites of the European Schools. Data is only transferred to the respective provider once you click such a link; their privacy policy then applies.
15. Recipients and transfers to third countries
Your data is only received by the service providers named above: CoSup, netcup, Cloudflare and, for emails, Google. Transfers to countries outside the EU or EEA are only possible with Cloudflare and Google (USA); the safeguards for these are described in sections 6 and 9. We do not sell data or pass it on for advertising.
16. Children and young people
Many of our visitors are minors. If you are under 16, please ask your parents before voluntarily giving us your name or email address.
17. Your rights
You have the following rights. To exercise them, simply send us an email at [email protected].
- Access to your stored data (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing (Art. 21 GDPR)
- Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
- Lodging a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (LfDI BW), Lautenschlagerstraße 20, 70173 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de
Last updated: 1 November 2026
The German version of this page is legally binding. The English and French versions are translations.