Website Privacy Statement

Introduction

Being the operator of our online offering, Bertelsmann Stiftung is the data controller in charge of processing personal data of any users of such online offering. You can find our contact details in the imprint of the online offering, while the contacts for questions concerning processing of the personal data are named directly in this Privacy Statement.

We, the Bertelsmann Stiftung, are strongly committed to protecting your privacy and your private and personal data. We collect, save, and use your personal data strictly in accordance with the provisions of this Privacy Statement and the applicable data protection provisions, including without limitation the European General Data Protection Regulation (GDPR) and national data protection provisions.
With this Privacy Statement, we wish to inform you to what extent and for what purpose your personal data is processed in connection with the use of our online offering.

Personal data
Personal data is all information about an identified or identifiable individual. This includes information about your identity such as your name, your e-mail address, or your postal address. Any information that cannot be directly linked to your identity (e.g. statistical details such as the number of users of the online offering) is, however, not considered to be personal data.

You can essentially use our online offering without disclosing your identity and without providing any personal data. In that case, we will merely collect general information about your visit to our online offering. However, some of the services offered require you to provide certain personal data. As a rule, we will process such data only for purposes connected with the use of this online offering, including without limitation for the provision of the desired information. Whenever personal data is collected, you are only required to provide the data that is absolutely essential. Also, you may be asked to provide additional details, which are optional information provided voluntarily. We let you know in each case whether the input fields are for mandatory or optional details. More specific details are provided in the relevant section of this Privacy Statement.

There is no automated decision-making on the basis of your personal data in connection with the use of our online offering.

Processing personal data
We store the information provided by you on protected dedicated servers located within the European Union. Technical and organisational measures are taken to protect such servers against loss, destruction, access, modification, or dissemination of your data by unauthorized persons. Access to your data will be permitted only to a limited number of persons in charge of the technical, commercial, or editorial support of the servers. Notwithstanding regular controls, full protection against all risks cannot be provided.

Your personal data is transmitted over the Internet in encrypted form. We use SSL (Secure Socket Layer) encryption for transmission of data.

Disclosure of personal data to third parties
We use your personal information exclusively for providing the provide services that you have requested from us. Insofar as we use external service providers in performing the service requested, such external service providers will also access the data exclusively for the purpose of performing the service. By taking the necessary technical and organisational measures we ensure compliance with privacy policies and we demand the same of our external partners.

Moreover, we will not disclose the data to any third parties, including without limitation for advertising purposes, without your express consent. We will disclose your personal data only if you have given your consent to disclosure of the data or insofar as we are entitled or obligated to do so under legal provisions and/or administrative or judicial orders. This may include, without being limited to, giving information for purposes of criminal prosecution, in order to avert danger, or in order to enforce intellectual property rights.

Legal basis of data processing
Insofar as we obtain your consent to processing your personal data, Article 6(1)(a) of the GDPR constitutes the legal basis for such data processing.

Insofar as we process your personal data because processing is necessary for the performance of a contract or is necessary under a quasi-contractual relationship with you, the lawfulness of data processing is based on Article 6(1)(b) of the GDPR.

Insofar as we process your personal data because processing is necessary for compliance with a legal obligation, the lawfulness of data processing is based on Article 6(1)(c) of the GDPR.

Furthermore, Article 6(1)(f) of the GDPR may constitute the legal basis for data processing, if processing of your personal data is necessary for the purposes of the legitimate interests pursued by our Foundation or by a third party, except where such interests are overridden by your interests or your fundamental rights and freedoms which require protection of personal data.

Throughout this Privacy Statement, we always point to the legal basis underlying our processing of your personal data.

Deletion of data and duration of storage
We invariably delete or block any personal data provided by you as soon as the purpose of storage of such data ceases to apply. However, we may continue to store your personal data beyond that, if such storage is governed by legal provisions to which we are subject, including without limitation the legal obligation to retain business records and documentation. In such a case, we will delete or block the personal data after the prescribed period of time has expired.

Use of our online offering

Use of cookies
Like many other websites, our online offering uses cookies. Cookies are small text files that are stored on your computer and store certain settings and data of your web browser for the exchange with our online offering. As a rule, a cookie contains the name of the domain from which the cookie file has been sent as well as information about the age of the cookie and an alphanumeric identifier.

Cookies enable us recognise your computer and make any default settings immediately available. Cookies help us to improve our online offering and to provide you with an even better service customised to meet your particular requirements. This also constitutes a legitimate interest in the processing of the data in accordance with Article 6(1)(f) of the GDPR.

The cookies we use are so-called session cookies that are automatically deleted after the end of the browser session. In individual cases, we may use cookies with a longer storage time so that your default settings and preferences may be considered when you visit our online offering the next time.

Most web browsers are set to accept cookies by default. However, you can disable the storage of cookies or set up your web browser to inform you when you receive a cookie. It is also possible to manually delete stored cookies in the browser settings. Please note that your use of our online offering may be limited or restricted if you refuse to save cookies or delete necessary cookies.

Analysis cookies
Our online offering uses cookies which, based on the technologies of etracker GmbH, allow the analysis of your user behaviour, so-called analysis cookies. We use these cookies to collect and save the following data:

• Frequency of page views
• Search terms used
• Use of website functions
• Shortened IP address
• Date and time of the query
• Access status/HTTP status code
• Respective data quantity transferred
•  Website from which the request comes
• Browser
• Operating system and its interface
• Language and version of the browser software

When storing website visitor data, certain data, including without limitation visitors' IP addresses, device and domain data, is stored in shortened and/or encrypted form so that the individual user cannot be identified based on the data. The data collected is never merged with other existing data, e.g. for the purpose of identifying an individual.

The IP address is shortened as soon as possible on an automated basis without you as a user having to carry out any special adjustments or configurations.

We use analysis cookies in order to improve the quality of our online offering and its contents and in order to examine and optimise the reach and searchability of our online offering. These purposes at the same time constitute a legitimate interest within the meaning of the legal basis for data processing in accordance with Article 6(1)(f) of the GDPR.

Registration

You can register for the use of our online offering. To register, you have to provide the data requested during registration, such as your name, address and e-mail address. In addition, we record the date and time of registration. During the registration process, we ask for your consent to using your data. That gives you the advantage of not having to enter this data every time you wish to use our online service or to place an order.

If you give your consent, processing of data provided for registration purposes is based on Article 6(1) (a) of the GDPR. If you register with us for the purposes of performance or initiation of a contract, the legal basis for processing of the data is additionally constituted by Article 6(1)(b) of the GDPR.

Upon registration, an account is created for you. The data in the account is stored as long as there is an active contact. If there has been no activity for a period of three years, the status of the contact is set to Inactive. You can at any time demand deletion of your account.

Applicant management

We publish job offers on our web page for which you can apply if you are looking for an employment with us. From the web page, your IP address will be forwarded to our applicant management system where you can apply for the respective job by logging in with your personal access data and by uploading the information and files required for the purpose. Upon receipt of an application sent over the applicant management system, your application files will be transferred electronically to the responsible staff members in our company. Further details on the processing of data for the application procedure can also be found in the privacy notice of the applicant management system. If you have applied for a job offer, your files will automatically be erased six months from the completion of the recruitment process, provided that such erasure does not conflict with any other legitimate interests. Such legitimate interests may include, for example, the need to meet the burden of proof in a proceeding based on the German General Act on Equal Treatment (AGG). If an application is sent without referring to a job offer (unsolicited application), the application files will be kept for as long as the application might be of interest to us. Even prior to the expiry of the stipulated retention periods, you are free at any time to have your application erased via your applicant profile. If your application is successful, the data provided will be stored, in compliance with the respective legal requirements, for the purpose of handling the employment relationship. In all other cases, the legal basis for storing your applicant data is your consent under Art. 6 (1) (a) of the GDPR.

Order processing

If you place an order, we will use your personal information only within our publishing house of Bertelsmann Foundation and the enterprises appointed to process the orders.

Storage and disclosure of data upon placement of an order
For order processing, we work together with a number of enterprises which are in charge of payment processing and logistics. We make sure that our partners also comply with data protection provisions. For instance, we disclose your address data (name and address) to the relevant transport and payment processing providers who deliver the ordered products to you. Processing of payments is based on invoices issued. In this case, Article 6 (1)(b) of the GDPR constitutes the legal basis for data processing. Processing of your personal data is necessary for performance of the contract made with you.

We store the data for the period required to perform the contract. In addition, we store such data for the legally prescribed period in order to meet any post-contract obligations and insofar as retention periods under commercial and tax law have to be complied with. This retention period normally is ten (10) years until the end of the relevant calendar year.

Communication with us

There are various ways of contacting us, including but not limited to the contact form on our website. In addition, we will be happy to inform you regularly by e-mailing you our newsletters which deal with various topics.

Contact form
If you wish to use the contact form of our online offering, we will collect the personal data that you provide in the contact form, including but not limited to your name and e-mail address. In addition, we record the date and time of your enquiry. We process any data transmitted through the contact form exclusively for the purpose of answering your enquiry or reacting to your concern.

It is up to you to decide what information you provide in the contact form. In accordance with Article 6(1)(a) of the GDPR, your consent constitutes the legal basis for processing your data.

After the matter has been dealt with, the data is stored for some time in case you have any further questions. Without prejudice to the relevant legal retention periods, you may request deletion of the data at any time, otherwise the data will be deleted once the matter has been conclusively dealt with.

Newsletter
If you subscribe to our newsletter, we will use your e-mail address for information purposes of Bertelsmann Foundation until you unsubscribe from the newsletter. You will be regularly updated by e-mail on current topics related to our projects and receive e-mails informing you of special occasions such as new studies and events. Such e-mails may be personalised and individualised on the basis of information we have about you.

Unless you have given us your consent in writing, we use the so-called double opt-in procedure for subscription to our newsletter, i.e. we will send you our newsletter by e-mail only once you have expressly confirmed that you want us to activate transmission of the newsletter. We will then send you a notification e-mail and ask you to confirm, by clicking on one of the links contained in that e-mail, that you wish to receive our newsletter.

If you have explicitly subscribed to our newsletter, your consent constitutes the legal basis for processing of your data in accordance with Article 6(1)(a) of the GDPR. Under the applicable legal provisions, we may send you our newsletter without having obtained your express consent based on the fact that you have ordered certain publications from us and we have therefore received your e-mail address and you have not objected to receiving information from us by e-mail. In this case, our legitimate interest in direct mailing constitutes the legal basis in accordance with Article 6(1)(f) of the GDPR.

If you do no longer wish to receive our newsletters, you can revoke your consent at any time with effect for the future and/or object to receiving the newsletter without incurring any costs other than the transmission costs in accordance with the basic tariffs. Simply use this unsubscribe link contained in every newsletter or send a message to us or our data controller.

Comments
You can comment our articles in our online offering. To do so, you have to give you name; you can also use an alias. In addition, you are required to let us know your e-mail address. We need your e-mail address to contact you in the event of any complaints about your posts and in order to ask you to comment on such complaints; in addition, we will store the IP address. You cannot post any comments unless you have provided those details. However, only the name or the alias selected by you will be shown together with the comment upon publication. In accordance with Article 6(1)(a) of the GDPR, your consent constitutes the legal basis for processing your data.

Push notifications

You can opt in to receive our push notifications. To send our push notifications, we use the delivery service "CleverPush", which is provided by CleverPush UG (haftungsbeschränkt), Tondernstr. 1, 22049 Hamburg ("CleverPush"). You will receive regular information about [please specify the content of the notifications as detailed as possible]. To opt in, you must confirm your browser's request to receive notifications. This process is documented and stored by CleverPush. This includes saving the opt in time and your browser ID or device ID. The collection of this data is required so that we can understand the processes in case of misuse and therefore serves our legal protection. To show you the push notifications, CleverPush collects and processes your browser ID on our behalf and your device ID in the case of mobile access. By subscribing to our push notifications, you agree to their receipt. Legal basis for the processing of your data after registration for our push notifications is in the presence of your consent Art. 6 para. 1 lit. a GDPR. CleverPush also statistically evaluates our push notifications. CleverPush can detect if and when our push notifications were displayed and clicked by you. Your consent to the storage and use of your personal information to receive our push notifications and the statistical survey described above may be revoked at any time with future effect. To revoke consent, you can change the setting to receive push notifications in your browser. If you use our push notifications on a desktop PC with the operating system "Windows", you can also unsubscribe our push notifications by right-clicking on the respective push notification in the settings that appear there. Your data will be deleted as soon as they are no longer necessary to achieve the purpose of their survey. Your data will be stored as long as the subscription to our push notifications is active. Under the following link, the process of unsubscribing will be explained in detail: https://cleverpush.com/faq.

Social Media
Our online offering contains links or plugins to the social networks Facebook, LinkedIn, Soundcloud, Twitter, Xing, YouTube. The links are identified by the logo of their relevant providers.

Clicking on a link opens the relevant social media web pages; this Privacy Statement does not apply to such web pages. For further details on the provisions applicable on such web pages please refer to the relevant privacy statements of each of the providers; you can find them at:

Facebook: http://www.facebook.com/policy.php

LinkedIn: https://www.linkedin.com/legal/privacy-policy

SoundCloud: https://soundcloud.com/terms-of-use

Twitter: https://twitter.com/privacy?lang=de

Xing: https://www.xing.com/privacy

Youtube: https://www.google.com/policies/privacy/?hl=en

No personal information is forwarded to the relevant providers before clicking on the links or calling up a plugin. Calling up the linked website also constitutes the basis for data processing by the relevant website provider.

Use of YouTube
Our online offering contains videos for which we use plugins from the Google-run site YouTube ("YouTube"). The operator of the service is YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. If you call up an internet page of our online offering which contains a video, a connection with the YouTube servers is created. On that occasion, the YouTube server is told which internet pages of our online offering you have visited.

If you are logged in to your YouTube account at that time, you allow YouTube to directly associate your browsing behaviour with your personal profile. You can prevent that by logging out of your YouTube account first. For further information on the handling of user data please refer to the Google privacy statement at https://www.google.de/intl/de/policies/privacy/ which also applies to YouTube.

Using YouTube enables us to show you videos and give you more information on ourselves and our projects; this at the same time constitutes our legitimate interest within the meaning of Article 6(1)(f) of the GDPR.

Your rights; contact

We, the Bertelsmann Foundation, are committed to explaining how we process personal data and to inform you about your rights as transparently as possible. If you want more detailed information or wish to exercise your rights, you can contact us at any time so that we can take care of your concerns.

Rights of persons concerned
You have extensive rights with respect to the processing of your personal data. First of all, you have an extensive right to information and under certain circumstances may demand correction and/or deletion or blocking of your personal data. You can also demand restriction of processing and you have a right of objection. You also have a right to data portability with a view to personal data that you have transmitted to us.

If you wish to assert any of your rights and/or want more detailed information concerning your rights, please use the contact form to get in touch with our staff. Alternatively, you may contact our data protection officer.

Revocation of consent and objection
You may at any time revoke your consent with future effect. Revocation of the consent does not affect the legality of any processing performed on the basis of such consent given up until the revocation thereof. In such cases, too, please use our contact form to get in touch with our staff and/or our data protection officer.

Insofar as the processing of your personal data is not based on consent given by you but on another legal basis, you can object to the data processing. Your objection will lead to a review and, if necessary, to termination of the data processing. You will be informed of the outcome of the review and – if the data processing is to be continued after all – you will receive further information from us on why the data processing is admissible.

Data protection officer; contact
We have appointed an external data protection officer who supports us in data protection issues and who you can contact directly. If you have questions regarding our handling of personal data or if you require other information on data protection issues, please do not hesitate to contact our Data Protection Officer and his team:

RA Dr. Sebastian Meyer, LL.M.
c/o BRANDI Rechtsanwälte
Adenauerplatz 1, 33602 Bielefeld
Phone: 052196535-812
E-mail: datenschutz@bertelsmann-stiftung.de

If you wish to contact our data protection officer personally by e-mail, you may send an e-mail to sebastian.meyer@brandi.net

Complaints
If you are of the opinion that the processing of your personal data does not comply with this Privacy Statement or the applicable data protection provisions, you can file a complaint with our data protection officer. Our data protection officer will review the matter and inform you of the outcome of the review. In addition, you are entitled to lodge a complaint with a supervisory authority.

Further information; amendments

Links to other websites
Our online service may contain links to other websites. Generally, these links are identified as such. We cannot control to what extent linked websites comply with the applicable data protection provisions. We therefore recommend that for other providers' data protection statements, you refer to the information given on their respective websites.

Amendments of this Privacy Statement
Any revision of this Privacy Statement is identified by the date specified (see below). We reserve the right to amend this Privacy Statement at any time with effect for the future. Amendments will be made, among other things, in case of technical adjustments of the online offering or changes of the data protection laws. The Privacy Statement as amended from time to time is always made available directly through our online offering. We recommend obtaining information on any changes of this Privacy Statement on a regular basis.

This Privacy Statement was last revised in: May 2019