Privacy Policy Hertie School Connect

We, Hertie School, Friedrichstraße 180, 10117 Berlin, Germany herewith inform you about the processing of personal data for which we are responsible in the sense of the EU General Data Protection Regulation (GDPR).

You can reach our data protection officer by sending an e-mail to hertie-school@daspro.de or by sending a letter to DPO Hertie School, daspro GmbH, Kurfürstendamm 21, 10719 Berlin

Below we have compiled the most important information on typical data processing for you, broken down by groups of data subjects. For certain data processing operations, which only concern specific groups, the information requirements are fulfilled separately. Where the term "data" is used, only personal data within the meaning of the GDPR are meant.

  1. Website Visitors of Hertie School Connect
  2. Hertie School Connect Members
  3. Hertie School Connect Guest Visitors
  4. Hertie School Connect Practice Partners
  5. Donors
  6. Event Participants
  7. Newsletter Recipients
  8. Rights of Data Subjects and Further Information

1. Website Visitors of Hertie School Connect
1.1 Server Log data
When using the website, certain information is sent to the server of our website by the browser used on your device for technical reasons. This data is stored and processed on our server.

(i) We process the following data for the purpose of providing the contents of the website that you have visited, to ensure the security of the IT infrastructure used, to correct errors, to enable and simplify searches on the website and to manage cookies.

(ii) The data processed is HTTP data: HTTP data is protocol data that is generated when the Website is visited via the Hypertext Transfer Protocol (Secure) (HTTP(S)) for technical reasons: This includes IP address, type and version of your Internet browser, operating system used, the page visited, the page previously visited (referrer URL), date and time of the visit. HTTP(S) data also accumulates on the servers of service providers (e.g. when requesting third-party content).

(iii) The legal basis for the processing is our legitimate interest in the operation of an Internet presence and the communication with communication partners in accordance with Article 6 (1) (f) GDPR.

(iv) The data is automatically transmitted by the browser of the user.

(v) Recipients of the personal data are IT service providers which we use as processors within the framework of a data processing agreement.

(vi) IP addresses are anonymized after 24 hours at the latest. Pseudonymous usage data will be deleted after 30 days.

(vii) Without disclosure of personal data such as the IP address, the use of the website is not possible. Communication via the website without disclosure of data is technically not possible.

1.2 Technically Required Cookies
We use Technically Required Cookies on our website. Cookies are small text files containing information that can be stored on the user's device via the browser when visiting a website. The information stored in cookies can be read out and processed when the website is visited again using the same device. In doing so, we use processing and storage functions of the browser of your device and collect information from the storage of the browser of your device.

Cookies that are technically required for the functioning of the website cannot be deactivated via the cookie management function of this website. However, you can generally deactivate cookies at any time in your browser. Different browsers offer different ways to configure the cookie settings in the browser. However, we would like to point out that some functions of the website may not function or no longer function properly if you generally deactivate cookies in your browser

a) Session Cookies
We use Session Cookies on our websites. This enables us to save the Member account, individual settings and certain user actions for the duration of your visit (e.g. login, acceptation of the cookie information).

(i) The purpose of data processing is to know, if the user is already a Member and to save the user-specific settings.
(ii) The processed data are data if the user is already a Member of Hertie School Connect and user-specific settings like the acceptation of the cookie information.
(iii) The legal basis for the processing is our legitimate interest in the provision of the individual sessions for the users in accordance with Article 6 (1) (f) GDPR.
(iv) The data is automatically transmitted by the browser of the user.
(v) Recipients of the personal data are IT service providers which we use as processors within the framework of a data processing agreement.
(vi) If you choose the option “stay permanently logged in” your data will be deleted after 30 days. Otherwise your data will be deleted 24 hours after you logged out.
(vii) Without disclosure of personal data the use of the website is not possible. Communication via the website without disclosure of data is technically not possible.

1.3 Social media content from third party providers
a) Soundcloud Embedding
There are links on our website to audio files that are stored and accessible on Soundcloud. As soon as you click the button to play a content from Soundcloud, the file is loaded from Soundcloud. Technically, the same thing happens as if you would go to the Soundcloud website via a link: Soundcloud receives all information that your browser automatically transfers (including your IP address). Soundcloud also sets its own cookies on your device. This also happens if you do not have a Soundcloud user account. If you are logged in to Soundcloud, your data is directly associated with your account. If you do not want your profile to be associated with Soundcloud, you must log out of Soundcloud before clicking on the audio file.

The collection and processing of this data is the sole responsibility of Soundcloud Limited, 20 Old Bailey, London, EC4M 7 AN, United Kingdom. We have no knowledge of further details of the processing of personal data or a possible data processing in the USA in the area of data controllership of Soundcloud. Hertie School has no influence on the data processing of Soundcloud.

For information about the processing of personal data by Soundcloud, please refer to the Soundcloud Privacy Policy: https://soundcloud.com/pages/privacy.

b) YouTube Embedding (Privacy Enhanced Mode)
On our website we include videos that are stored on YouTube. In this embedding, the contents of the YouTube website are displayed in parts of a browser window. However, the YouTube videos are only accessed by clicking on them separately. The embedding of YouTube content is carried out in the so-called "Privacy Enhanced Mode". This is provided by Google as the provider of YouTube and thus ensures that no data is transmitted to Google and no cookies are stored on your device before a click to play the video.

As soon as you click the button to play the YouTube content, the video is loaded from YouTube. Technically, the same thing happens then as would happen if you clicked a link to go to the YouTube website: YouTube receives all information that your browser automatically transmits (including your IP address). YouTube also sets its own cookies on your device. This also happens if you do not have a YouTube user account. If you are logged in at YouTube or Google, your data will be associated directly with your account. If you do not want the association to your YouTube or Google user account, you must log out of YouTube and Google before clicking on the video file.

The collection and processing of this data is the sole responsibility of Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Irland. Google Ireland Limited uses Google LLC in the USA (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) as its service provider.
We have no knowledge of further details of the processing of personal data or a possible data processing in the USA in the area of data controllership of Google. Hertie School has no influence on the data processing of Google.

For information about the processing of personal data by Google, please refer to the Google Privacy Policy: https://policies.google.com/privacy.

2. Hertie School Connect Members
(i) The purpose of the processing is the operation of Hertie School Connect as a platform for students, alumni, employees and Practice Partners of the Hertie School for networking, job search, offering a market place and for the exchange of information about events, apartments, learning foreign languages or hobbies.
(ii) The processed data are:

  • Registration data (registration via email)
    This includes all data you provide during the registration process, such as your name, email address, password
  • LinkedIn registration data (registration via LinkedIn)
    If you choose to register via your LinkedIn Account, your LinkedIn account data will be processed like your name, primary email address associated with your LinkedIn account
  • Profile data

This includes all data that you voluntarily enter in your profile, for example your name, photo, birth date, address, stages of your study path, your current employer, job and previous positions, your languages, links to your social media profiles, your fields of interest, ways you are willing to help other members, and any additional personal information you are free to provide. You can design your profile yourself according to your preferences.
(iii) The legal basis for the processing is the Membership Agreement for Hertie School Connect in accordance with Article 6 (1) (b) GDPR.
(iv) The data is provided by the Hertie School Connect Members.
(v) The recipients of the Profile data are the other Members of Hertie School Connect. We use service providers as processors within the framework of a data processing agreement for the provision of services, especially for the provision, maintenance and servicing of IT systems.
If you allow a connection to your LinkedIn profile and log in to Hertie School Connect using your LinkedIn registration details, LinkedIn is solely responsible for the processing of personal data in your LinkedIn profile. Hertie School has no influence on the data processing of LinkedIn. The LinkedIn privacy policy applies: https://www.linkedin.com/legal/privacy-policy
According to LinkedIn you can deactivate the sharing of data from your LinkedIn profile to third parties (in this case Hertie School) at any time by yourself in your LinkedIn profile in the Privacy Section.
(vi) The data of Hertie School Connect Members will only be deleted when the membership ends. Members can change all information in their profile at any time or delete their profile completely. Booking relevant data is stored for a period of 10 calendar years.
(vii) Without the personal data, a membership in the Hertie School Connect is not possible.

3. Hertie School Connect Guest Visitors
(i) The purpose of the processing is the operation of the Hertie School Connect as a networking platform for students, alumni, employees and practice partners of the Hertie School. Guest visitors who aren´t Members of Hertie School Connect should also be invited to certain sub-pages of the Hertie School Connect by a link and be able to register for events.
(ii) In addition to the data of the website visitors mentioned in Section 1 of this Privacy Policy, the processed data may include the name, email address and registration data for events and payment data for events involving costs.
(iii) The legal basis for the processing is our legitimate interest in the operation of a networking platform with limited access possibilities also for Guest Visitors according to Article 6 (1) (f) GDPR.
(iv) The data is provided by the Hertie School Connect Guest Visitors.
(v) We use service providers as processors within the framework of a data processing agreement for the provision of services, especially for the provision, maintenance and servicing of IT systems.
(vi) The data of Guest Visitors of Hertie School Connect will be deleted after six months. Booking relevant data will be stored for a period of 10 calendar years.
(vii) Without the personal data, it is not possible to use the Hertie School Connect platform as a Guest Visitor.

4. Hertie School Connect Practice Partners
(i) The purpose of the processing is the operation of the Hertie School Connect as a networking platform for students, alumni, employees and practice partners of the Hertie School.
(ii) The processed data of the practice partners are:

  • Registration data (registration via email)
    This includes all data you provide during the registration process, such as your name, email address, password.
  • Profile data

This includes all data that you voluntarily enter in your profile, for example your name, photo, birth date, address, stages of your study path, your current employer, job and previous positions, your languages, links to your social media profiles, your fields of interest, ways you are willing to help other members, and any additional personal information you are free to provide. You can design your profile yourself according to your preferences.

  • Profile data of the Practice Partner sites

This includes all data that you voluntarily provide on your Practice Partner site. This includes the name and description of your organization, a logo, your offers to members, and contact data including postal address, email address, phone number and website of your organization.
(iii) The legal basis for the processing is the Practice Partner Agreement for Hertie School Connect in accordance with Article 6 (1) (b) GDPR.
(iv) The data is provided by the Hertie School Connect Practice Partners.
(v) The recipients of the data are the Members of Hertie School Connect and the other Practice Partners. We use service providers as processors within the framework of a data processing agreement for the provision of services, especially for the provision, maintenance and servicing of IT systems.
(vi) The data of Practice Partners of Hertie School Connect will only be deleted when Practice Partnership ends. The Practice Partners can change all information in their Practice Partner sites at any time or delete their Practice Partner sites completely.
(vii) Without the personal data, participation as a Practice Partner in the Hertie School Connect is not possible.

5. Donors
(i) The purpose of data processing is to receive donations from donors and to manage the donations received. A further purpose is - if consent has been given - the publication of the names of the donors on the website in a “public list of supporters of Hertie School” in order to motivate further persons to donate.
(ii) The processed data are name and email address, the specific fund (i.e. Student, Alumni or General) payment amount and payment data like bank details.
(iii) The legal basis for the processing of the donations is the donation contract in accordance with Article 6 (1) (b) GDPR and Article 6 (1) (c) GDPR (statutory obligations, in particular tax and commercial law provisions). The legal basis for listing the supporters of Hertie School on our website is your consent according to Article 6 (1) (a) GDPR.
(iv) The data is provided by the Donors.
(v) Banks and payment providers may be recipients of data for the processing of payments. We use service providers as processors within the framework of a data processing agreement for the provision of services, especially for the provision, maintenance and servicing of IT systems.
(vi) Booking relevant data is stored for a period of 10 calendar years.
(vii) Sending donations to Hertie School is voluntary and not obligatory. Without personal data, it is not possible to make donations is not possible.

6. Event Participants
(i) We will process your data for the purpose of holding the event and for the documentation of the event by means of film and sound recordings and the use of the resulting recordings for the purpose of press and public relations work and for the creation of a participant brochure. A change of these purposes is not planned.
(ii) The processed data are:

  • surname, first name, e-mail address, study program, final year, current institution and position
  • overview of the selected event points
  • Bank and payment data for events involving costs
  • information whether or not the person agrees with the two options (brochure/photos) mentioned above
  • film and sound recordings (if you have given your consent)

(iii) The legal basis for the processing of data of Participants in events is Article 6 (1) (b) GDPR (contract to hold the event) and Article 6 (1) (c) GDPR (legal obligations, in particular tax and commercial law regulations). The legal basis for the production of image and sound recordings and its publication and the participants' brochure is your consent in accordance with Article 6 (1) (a) GDPR. Your consent is given voluntarily, participation in the event is also possible without the provision of your consent for recordings and participant brochures.
(iv) The data is provided by the Event Participants. The film and sound recordings are made by the Hertie School if you have given your consent.
(v) For the purpose of press and public relations work, the recipient of the image and sound recordings can be anyone, in particular journalists, media companies, press and photo agencies, members, employees, website visitors, users of social media. Banks and payment providers may be recipients of data for the processing of payments. We use service providers as processors within the framework of a data processing agreement for the provision of services, especially for the provision, maintenance and servicing of IT systems.
(vi) When publishing film and sound recordings on the Internet (Hertie School website, social media platforms of the Hertie School, film recordings in videos (e.g. YouTube)), data is regularly transferred to so-called third countries outside the European Union, which are to be regarded as unsafe third countries in terms of data protection. Hertie School has no influence on how the social media providers handle the data. Hertie School has no knowledge of whether and for what purposes the data is further processed in the third country.
(vii) Archived film and sound recordings of the events as well as publications are generally not deleted. All data relevant to the contract and bookings will be stored in accordance with tax and commercial law retention periods for a period of ten calendar years after the end of the contract. Further data collected in the course of the event will be deleted six months after the event has taken place.
(viii) The provision of personal data is contractually binding for participation in events. It is not possible to participate in events without providing personal data. The production of film and sound recordings and the participants' brochure is not obligatory for participation in the event.

7. Newsletter Recipients
If you subscribe to a newsletter, we will send you information about Hertie School and the topics that you choose.
(i) The purpose of the processing is to send newsletters. A change of this purpose is not planned.
(ii) The data processed are your email address and your personal preferences of the newsletters you subscribe to.
(iii) The legal basis for the processing of data for newsletters is your consent (Article 6 (1) (a) GDPR).
(iv) The data is provided by the Newsletter Recipients.
(v) You provide your contact details yourself when you subscribe to the newsletter.
(vi) We use service providers as processors within the framework of a data processing agreement for the provision of services, especially for the provision, maintenance and servicing of IT systems.
(vii) Data relating to newsletters are deleted when you unsubscribe. A revocation of the consent is possible at any time. Please use the unsubscribe function in the newsletter.
(viii) Personal data is required to receive newsletters. Without providing personal data, the newsletters cannot be sent.

8. Rights of Data Subjects and Further Information
(i) We do not use any methods of automated individual decision-making.
(ii) You have the right to request information at any time about all your personal data which we are processing.
(iii) If your personal data is incorrect or incomplete, you have the right to have it rectified and completed.
(iv) You can request the erasure of your personal data at any time, as long as we are not bound by legal obligations that require or allow us to continue processing your data.
(v) If the applicable legal requirements are met, you can request a restriction to the processing of your personal data.
(vi) You have the right to object to the processing, insofar as the data processing is based on profiling or direct marketing purposes.
(vii) If the processing is carried out on the basis of the balancing of interests, you may object to the processing by stating reasons arising from your particular situation.
(viii) If the data processing takes place on the basis of your consent or a contract, you have the right to a transfer of the data provided by you, insofar as the rights and freedoms of others are thereby not impaired.
(ix) If we process your data on the basis of a declaration of consent, you have the right to revoke this consent at any time with future effect. The processing carried out prior to a revocation remains unaffected by the revocation.
(x) Moreover, you have the right to file a complaint at any time with a data protection supervisory authority, if you believe that data processing has been carried out in violation of the applicable law.

Version: August 4, 2020

Hertie School Connect is hosted by www.ndalumni.de