▤For education and courses

Stricter requirements — in several places at once.

What you should know:

• Consent: for children under 16, the consent of those with parental responsibility is required (this is the age limit that applies in Germany). Where both parents have parental responsibility, you generally need both.
• Photos: the same, and here with particular care. A class photo on the website without consent is a common and serious breach.
• Information obligations must be fulfilled in language that children understand, if the information is aimed at them.
• Data minimisation carries more weight: what you do not need, you do not collect.

What this means in practice: obtain consent in writing, with a clear scope and the option to withdraw it — and file it where it can be found again.

Only with consent, and for minors with that of those with parental responsibility.

What works in practice:

• Obtain consent at the start of the school year or course, in writing, with a clear scope: for what, where, for how long.
• Keep a list of who has agreed and who has not — and have it with you when taking photos.
• Shots from behind and overview shots, where individuals cannot be recognised.
• Withdrawal possible at any time — then remove the picture, without discussion.

What is not enough: a sentence in the registration form. Consent must be recognisable, voluntary and separate.

And think about the end: consent for one school year does not apply for ever. Pictures of children who left the institution long ago should be taken down.

Via a form or the event registration — with one decision beforehand: what do you really need?

For a course registration, this is usually enough:

• Name of the participant.
• For minors: name and contact details of those with parental responsibility.
• A way to get in touch.

What is often asked for unnecessarily: date of birth (unless there is an age limit), address (unless you invoice), occupation, previous knowledge as free text.

What you must communicate: what the data is collected for, how long it is kept, who sees it.

And for courses with a fee, the whole of consumer protection law comes on top — price information, information obligations, terms of participation.

Separately by occasion, and always in such a way that nobody sees the others’ addresses.

Three kinds of messages:

1. Organisational matters about day-to-day operation — dates, cancellations, parents’ evenings. This is not advertising and needs no separate consent, but it does need a legal basis arising from the contract or care relationship.
2. Offers — additional courses, holiday programmes with costs. That is advertising and needs consent.
3. Urgent matters — cancellation on the same day. There should be a second channel for this, not just email.

And the case that happens particularly often in this sector and is particularly unpleasant: the parents’ email with an open distribution list. Then everyone can see whose child is in which group.

What parents and interested people want to know before deciding:

• What is on offer, in clear words and with age ranges.
• Dates and times — up to date, otherwise the site looks abandoned.
• Costs, if there are any. Complete, including extras.
• How to register and by when.
• Who teaches. In education, people decide about people.
• How to reach you and how quickly you reply.

What also works: an FAQ page. In this sector, the same questions are asked anew every year — care hours, holidays, make-up dates, cancellation.

And what must be up to date, because otherwise it does harm: the dates. A course schedule from last year says that nobody is looking after this.

As an editorial plan — in your case, it almost writes itself.

A typical year:

• January/February: registration for the coming school year, open day.
• March to May: holiday programmes, end-of-year events.
• June/July: end of the school year, review, holiday care.
• August/September: start, new courses, free places.
• October to December: interim reports, Christmas offers, planning.

What that is worth: in January you know what needs doing in September — and can prepare in advance.

And the practical tip: registration deadlines and holiday dates belong in the calendar as soon as they are fixed. What is decided in February is forgotten by July.

Quite a lot, and it applies in addition to everything else:

• Accessibility. Public bodies have been subject to strict requirements for years. This directly affects the website and is not a recommendation but an obligation.
• Accessibility statement on the website, with a feedback mechanism.
• Public procurement law, if you commission a service provider — depending on the contract value.
• State data protection laws apply alongside the GDPR.
• Official requirements of the governing body, which can go beyond the law.

What you should do before introducing anything: ask the governing body. In many cases there are already rules on which systems may be used, and switching later is expensive.

With an independent governing body, most of this does not apply; the data protection requirements remain.

Four things that make sense even without an obligation — and that make up most of it:

1. Sufficient contrast. Light grey text on white is unreadable for many people.
2. Alt texts on images.
3. Clear labels on form fields.
4. Operability with the keyboard, without a mouse.

In addition, for public bodies:

• Accessibility statement with a way to send feedback.
• Easy-to-read language for key content — at least notes on it.
• Sign language for the most important information, depending on the requirements.

What you can do straight away: use your site with the keyboard only once. If you cannot get to the contact form that way, nobody who cannot use a mouse will get there either.

For as long as it serves a purpose, and that usually ends with the course.

As a guide:

• Registration data for a completed course: delete after the end and invoicing.
• Certificates of attendance: as long as they might be requested — often one to three years.
• Accounting records: tax retention periods, six to ten years.
• With a public-sector governing body: often separate retention rules that take precedence.

What you should set up: a date after each course ends on which you tidy up. Otherwise a collection of children’s data from five years grows for which there is no longer any reason.

And when deleting, remember: lists on drives too, printed attendance lists and exports. Those are regularly forgotten.

With a clear separation between enquiry and registration — and one status per person.

What has proven itself:

• One status per registration: enquired, confirmed, paid, attended, cancelled.
• Waiting list as a status of its own, not as a note.
• A fixed date shortly before the course starts on which everything is gone through.

What goes wrong most often in practice: cancellations that are not processed. Anyone who cancels but is still on the list blocks a place, and someone on the waiting list does not get it.

And send a confirmation as soon as a place is secure. The most common question in this sector is: “Did it work?”

Two things that are easily confused:

• Volunteers work unpaid or for an expense allowance.
• Freelancers are self-employed — and this is where bogus self-employment lurks.

What you should record:

• Availability and working times.
• Qualifications and proof — in education, often enhanced certificates of good conduct. The note that it was presented and when belongs in the system; the document itself does not.
• Agreements — fee, scope, notice.

That leaves the question to ask before every engagement: is this really self-employed work? Anyone with fixed hours who is bound by instructions and integrated into the organisation may not be — with considerable consequences in an audit.

For anything that belongs to the core educational or administrative work:

• Grade management and school reports.
• Pupil records and support plans — with specially protected data.
• Timetabling and arranging cover.
• Invoicing according to state requirements.

There are specialist applications for these, which must meet your governing body’s requirements and are often mandatory for public-sector bodies.

What it is good for:

• Prospective participants and registrations.
• Communication with parents and participants, where it is organisational.
• Cooperation partners, sponsors, volunteers.
• The website with courses, dates and registration.

The separation should be written down once and discussed in the team — otherwise support plans end up in a note.