Applies to the website mathezeit.de, the MatheZeit Lernsystem and the MatheZeit app
MatheZeit UG (haftungsbeschränkt)
represented by the managing director Mats Lorenzen
Kallehoe 27
24988 Oeversee, Germany
Email: info@mathezeit.de
Register court: Amtsgericht Flensburg (Flensburg Local Court), HRB 18391 FL
When MatheZeit is used at school, the school is the controller under data protection law (Art. 4(7) GDPR, General Data Protection Regulation) for the processing of pupils' data. The school decides on the purposes and means, directs the use in lessons and knows which code belongs to which child. In this respect, MatheZeit UG acts as a processor (Art. 28 GDPR) on the basis of a data processing agreement.
At MatheZeit you do not have to give your name. You log in only with your code. You get the code from your teacher.
We save which tasks you have done, what was right or wrong and whether you asked for help. This helps the tasks fit you better. It also helps your teacher to help you.
If your teacher wants to help you, your teacher can see during the lesson what you are doing on your MatheZeit page right now. Your screen then shows that your teacher is watching. Nothing is saved.
Your teacher can see your learning progress. This is there to help you and to give you the right tasks. You do not get a mark for it.
Sometimes your teacher looks at which children in the class need more practice right now. Only your teacher sees this, not your classmates. You always see only your own progress. Children's names are not put in a ranking.
Your teacher can also look at how you solved a task: what you placed where, or which number you typed in. For this, the task is built up again. No photo is taken of your screen.
The learning helper Mazio is an AI. That is a computer program, not a person. In the Knobelbox and in the Basiscamp you can talk to him about a task. For this he only gets the maths task and your answer, never your name or who you are. In the MatheZeiten Mazio helps you too, but there nothing is sent to another computer. We keep the conversations from the Knobelbox and the Basiscamp so that we can make Mazio better. Your code and the time are not stored there.
Your data is not sold, not used for advertising and not used to train an AI.
If you have a question, ask your parents or your teacher.
We process personal data on the basis of the GDPR, national data protection law (in Germany the BDSG, Federal Data Protection Act) and the school law provisions of the country in which the school is operated. We are guided by the principles of Art. 5 GDPR: data minimisation, purpose limitation, storage limitation and transparency.
A detailed description of the technical and organisational measures under Art. 32 GDPR is provided to schools in our Data Protection and Security Information for Schools.
Children log in at mathezeit.de/anmelden with an eight-character access code issued by the teacher. No names, email addresses or other personal details of the children are collected. The code is a pseudonym.
The codes are generated at random and cannot be derived from other codes. The number of login attempts is limited. Whether an entered code exists is not disclosed. Transmission and storage are encrypted, and access rights are restricted to what is necessary.
The code is transmitted only at login. After that, the login is carried by a session cookie (section 4.5); the code does not appear in any address bar or in any further request.
If a teacher optionally assigns a real name to a code, that name is stored in encrypted form. The key is derived from the teacher's PIN and is not held by us; the real name is technically not accessible to us.
So that a child can recognise itself without a name, it receives a number within its class and, derived from that number, a pseudonym with an animal motif, for example “Loyal Crocodile”. Number and pseudonym apply only within the class and, without the teacher's list, do not allow any conclusion to be drawn about a specific person.
Under the pseudonymous code we store:
This data is used for the evaluation of learning progress by the teacher and for controlling the selection of tasks. No processing for advertising or other purposes takes place.
Legal basis: Art. 6(1)(e) GDPR in conjunction with the school law and data protection provisions of the respective country (for schools in Germany, for example § 11 SchulDSVO SH, the School Data Protection Ordinance, in Schleswig-Holstein).
The learning environment adapts the task type and difficulty to the child's learning progress. Only pseudonymous learning data is evaluated for this, such as the success rate at the first attempt and recurring error types. The adaptation serves individual support. No automated decision with legal or similarly significant effect within the meaning of Art. 22 GDPR takes place. The selection of the next task follows fixed rules set by us, based on the results of the most recently solved tasks, and affects only this selection. The teacher can instead choose a fixed difficulty level for a child.
The teacher sees the learning progress of the children in their own classes: which tasks were worked on, how many of them were correct, which answers the child gave, how often hints were used and the indicators calculated from this. Access is limited to the teacher's own classes.
Login times, usage times and working durations of individual children are not shown to the teacher. We use the time and duration of work on a task only by machine, for task control (section 4.3) and for assignment to the lesson.
View of the child's work. For a completed task, the teacher can display how the child solved it; for this, the task is rebuilt in the teacher's browser from the stored answers (section 4.2). No screen image is transmitted and nothing is recorded. The purpose is to recognise misconceptions; the view is visible only to the teacher of the child's own class and is deleted together with the learning data at the end of the school year.
Klassenbild. In addition, the teacher can set up the “Klassenbild” (class overview) for a class (this is the name used in the application; hereinafter also “classification”). The teacher places the learning progress within the class in order to identify support needs and to provide tasks in a targeted way. Insofar as a comparative classification takes place, this may constitute profiling within the meaning of Art. 4(4) GDPR. This processing is carried out exclusively on a pseudonymous basis, serves educational support and not the evaluation of the child's personality, and is safeguarded by the following measures:
Live view during the lesson. During a lesson that has been started, the teacher can see what an individual child in their class is currently doing on the learning page, in order to help that child specifically. For this, the structure of the learning page is transmitted to the teacher's browser and reproduced there.
The following limits apply to this function:
Activity display. Independently of this, during the lesson the teacher sees in an overview which children are currently practising and which task or MatheZeit they are working on. This status is held only in working memory and ends with the lesson.
Instructions to the class. During a lesson that has been started, the teacher can direct the children of their class jointly to a specific task or end their login. This is a teaching instruction to the whole class; it is not directed at individual children, and no data about individual children is generated.
Legal basis: Art. 6(1)(e) GDPR in conjunction with the school law of the country in which the school is operated (in Germany, for example § 11 SchulDSVO SH: conduct and supervision of lessons).
After login we set a technically necessary cookie:
| Name | Purpose | Duration |
|---|---|---|
mz_schueler_sitzung | Recognise the logged-in child so that the code does not have to be entered again | 45 minutes without activity, at most 12 hours, and in any case until the end of the day. In addition, the browser deletes it on closing |
The cookie cannot be read by JavaScript and contains no information about the child, only a random session key. We set no further cookies in the pupil area. No consent is required for this technically necessary cookie (Art. 5(3) of the ePrivacy Directive as implemented in national law; in Germany § 25(2) no. 2 TDDDG, Telecommunications Digital Services Data Protection Act).
For the session we store on the server the session key in hashed form, the access code, the class, the expiry time and the time of the last activity. Because tablets in class sets are passed between children, a session ends
On a shared device, the login page shows who is still logged in there, so that no one inadvertently continues working under someone else's login.
Mazio gives children feedback and hints while they practise. A language model is used at only one point: in the conversation about a task in the Knobelbox and in the Basiscamp. No language model is used in the MatheZeiten; Mazio's feedback there is generated within the learning environment itself, without tasks or answers being transmitted to a provider. The following sections 5.1 to 5.3 concern only the conversation in the Knobelbox and in the Basiscamp.
Only the task and the answer given are transmitted to the provider of the language model: without name, without login code, without IP address and without session data. The provider therefore receives no information that would allow attribution to a specific child.
There is no free text input in the learning path through which a child could enter personal details.
The request never reaches the language model directly. It passes through our own servers; only there is the request to the model assembled and forwarded. The provider sees only a request from our server.
The learning environment, the task control and the storage of learning data are operated in Germany. For linguistic feedback we use only models that are operated in data centres within the EU:
| Model | Operation |
|---|---|
| Claude (Anthropic) | via our infrastructure provider, EU region Frankfurt am Main |
| Mistral AI | via our infrastructure provider, EU region Frankfurt am Main |
| Self-hosted language model | on our own processing server in Frankfurt am Main, without an external provider |
The providers involved are listed in section 8.
At the provider of the language model, the transmitted content is not stored permanently, not used to train AI models and not passed on to third parties. The models are operated at our infrastructure provider in environments to which the model providers have no access.
On our side, we record the task, the answer given and the course of the conversation, without access code, without time of day (only the date) and without any other identifier of the child. We do not link these records to the learning data. We use them solely to check and improve the quality of the hints; deletion after 12 months (section 9).
Mazio supports practising. It does not carry out any performance assessment and is not intended for that purpose. All educational and performance-related decisions are taken by the teacher.
Mazio is an AI system within the meaning of Art. 3(1) of Regulation (EU) 2024/1689 (AI Act). MatheZeit UG is its provider (Art. 3(3)); schools that use MatheZeit in lessons are deployers (Art. 3(4)). Children are informed in the application that the hints come from a computer program and not from a person (Art. 50 AI Act); this section supplements that notice but does not replace it.
Mazio gives hints and asks questions about the task a child is currently working on. It does not award marks and takes no decisions on admission, promotion to the next year, support needs or educational level; such decisions are taken by the teacher. Mazio is not a high-risk AI system within the meaning of Annex III of the AI Act. We provide schools with our classification and the reasons for it, and we will review it as soon as the European Commission has finally adopted its guidelines on classification.
During a lesson that has been started, the teacher can read along in the live view (section 4.4) which hints Mazio is currently giving a child. Afterwards, the conversations are not attributed to any child. We explain to teachers in the application how Mazio works, with rules and examples. Mazio's hints are not included in any assessment.
On registration we store your name, email address and school affiliation. Passwords are stored exclusively as a cryptographic hash, never in plain text. Login takes place at mathezeit.de/anmelden via a system operated by us on our server in Germany.
For the first login and if you forget your password, we send a six-digit code to your email address. It is valid for 20 minutes and is used to set a new password. The same login procedure applies in the MatheZeit app.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
| Name | Purpose | Duration |
|---|---|---|
mz_teacher_session | Recognise the logged-in teacher | 24 hours; 7 days when logging in via an invitation link |
We set no further cookies. There are no analytics cookies, no tracking and no comparable services. No consent is required for the technically necessary session cookie (Art. 5(3) of the ePrivacy Directive as implemented in national law; in Germany § 25(2) no. 2 TDDDG).
Via the chat in the application, teachers can send us questions, feedback and error reports. In doing so, the name, work email address and message text are processed and stored by us so that we can follow the history of the conversation.
The messages are processed exclusively on our own servers in Germany and are not passed on to third parties.
Legal basis: Art. 6(1)(b) GDPR.
If you consent to the newsletter, we use your email address to send you information about MatheZeit. You can withdraw your consent at any time via the unsubscribe link in every message or by email to info@mathezeit.de.
Legal basis: Art. 6(1)(a) GDPR.
When a page is accessed, the web server automatically stores:
192.0.2.*)This data is used for operation and troubleshooting. It is not combined with other data sources. The log files are deleted automatically after 14 days.
A separate error log contains the full IP address for the purpose of defending against automated attacks. It is evaluated solely for this purpose and is likewise deleted after 14 days.
Legal basis: Art. 6(1)(f) GDPR (security and stability of the service).
We deliver fonts via Bunny Fonts (BunnyWay d.o.o., Slovenia). No connection to Google servers is established.
We deliver the images, design elements and scripts of our pages from our own server. External content delivery networks are not embedded. The fonts under section 7.2 are the exception.
If you use the contact form, we process the details you enter (name, email address, organisation, subject and message) and the time of submission. To prevent misuse, we additionally store the IP address in hashed form and the browser identifier. The data is deleted as soon as your request has been dealt with.
Legal basis: Art. 6(1)(b) GDPR; for the prevention of misuse, Art. 6(1)(f) GDPR.
We use no social media plugins, no external analytics services and no advertising tracking.
Processing chain when used at school: School (controller) → MatheZeit UG (processor) → the providers listed below.
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting of the platform and the learning data | Germany (Nuremberg) |
| OVHcloud (OVH SAS) | Processing server for the learning assistant | EU (Frankfurt am Main) |
| Amazon Web Services | Operation of the language models; receives no personal data (section 5.1) | EU region Frankfurt am Main; EU standard contractual clauses as a precaution |
| BunnyWay d.o.o. | Delivery of the fonts | EU (Slovenia) |
All processors process the data exclusively within the European Union. No transfer to third countries takes place. Data processing agreements are in place with all processors; we provide the evidence to schools as controllers on request.
Beyond the providers in this table, we do not pass on any data to third parties.
| Data | Retention period |
|---|---|
| Server log files | 14 days |
| Children's learning data | until the end of the school year, then deletion |
| Pupil codes and classes | until deleted by the teacher, at the latest at the end of the school year following the last use |
| Activity status for the view during the lesson | no storage; working memory only, ends with the lesson |
| Records of the learning assistant (without identifier) | 12 months |
| Teacher account | until deleted by the teacher or on request |
| Children's session (cookie and server entry) | 45 minutes without activity, at most 12 hours, at the latest at the end of the day |
| Session cookie (teachers) | 24 hours; 7 days with invitation link |
| Login code by email (teachers) | 20 minutes |
| Contact form | until the request has been dealt with |
| Support and feedback chat | 24 months |
| Newsletter consent | until withdrawn |
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20).
Objection. Insofar as data is processed on the basis of Art. 6(1)(e) or (f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). For pupils' data, please address the objection to the school; the school examines it and we implement it, for example by setting the task adaptation for the child to a fixed level chosen by the teacher.
To do so, please contact info@mathezeit.de.
When MatheZeit is used at school, please address requests concerning pupils' data to the school as controller. We support the school in fulfilling these rights. The records of the learning assistant contain no identifier of the child and are not linked to learning data (section 5.3); they therefore cannot be attributed to any person.
You may lodge a complaint with a data protection supervisory authority. As a rule, the competent authority is that of the country or federal state in which the school or the data subject is located. For Germany, an overview of the authorities of the federal states is available at bfdi.bund.de.
There is no single authority for all countries. The European Data Protection Board lists the supervisory authorities of all member states of the European Union and the European Economic Area at
edpb.europa.eu
MatheZeit UG (haftungsbeschränkt)
Kallehoe 27, 24988 Oeversee, Germany
Email: info@mathezeit.de
Last updated: 6 September 2026
This version is a translation of the German version dated 6 September 2026 and is provided for information purposes. In the event of discrepancies, the German version prevails.