Introduction
As the operator of the online offer, we – CHE Gemeinnütziges Centrum für Hochschulentwicklung GmbH (CHE Centre for Higher Education, or CHE) – are the controller responsible for processing the personal data of users of our online offer. You will find our contact details in the Legal Notice of our online offer; the contacts for questions concerning the processing of personal data are named directly in this Privacy Policy.

We – CHE – take the protection of your privacy and of your private data very seriously. We only record, store and use your personal data in accordance with the content of this Privacy Policy and with the applicable data protection regulations, and especially those laid out in the European General Data Protection Regulation (GDPR) and in national data protection regulations.

This Privacy Policy aims to inform you of the scope and purposes of the processing of personal data in connection with the use of the online offer.

Personal Data
Personal data means any information relating to an identified or identifiable natural person. This includes any information relating to your identity such as your name, your email address or your postal address. In contrast, information that cannot be associated with your identity (for example, statistical information on aspects such as the number of users of the online offer) is not regarded as personal data.

As a general rule, you may use our online offer without disclosing your identity or specifying any personal data. In this case, we will only record general information relating to the visit to our online offer. However, personal data concerning you will be recorded for some of the services offered. As a matter of principle, we shall then only process these data for the purpose of the use of this online offer, and especially for the provision of the requested information. During the collection of personal data, only mandatory data that are essential need be given. In addition, further information may be provided, but this information is then freely given. We point out in each case whether mandatory fields or optional details are involved. We will inform you of the specific details in the corresponding section of this Privacy Policy.

Automated decision-making based on your personal data shall not occur in connection with the use of our online offer.

Processing of Personal Data
We store your data on specially protected servers within the European Union. Technical and organisational measures are taken to ensure these servers are protected against loss, destruction, access, modification or distribution of your data by unauthorised persons. Only a small number of authorised persons have access to your data. These persons are responsible for the technical, commercial or editorial support of the servers. Despite regular checks, it is not possible to provide complete protection against all risks.

The transmission of our websites and of your entries on our websites via the internet generally takes place unencrypted. It therefore cannot be ruled out that third parties may be able to view and/or access the transmitted data. We recommend that you consider this aspect when deciding whether to transmit data to us via the internet, and which data you wish to transmit.

Disclosure of Personal Data to Third Parties
As a matter of principle, we only use your personal data to provide the services you have requested. If we use external service providers in the course of providing the service, they too shall only access the data for the purpose of providing the service. We take technical and organisational measures to ensure compliance with data protection requirements, and oblige our external service providers to do the same.

In addition, we will not disclose your data to third parties, particularly not for advertising purposes, without your consent. Your personal data will only be disclosed if you have agreed to the data transfer or where we are entitled or obliged to do so due to legal provisions and/or official or court orders. This may especially be the case concerning the provision of information for law enforcement purposes, to avert danger or to enforce intellectual property rights.

Legal Basis of Data Processing
Where we obtain consent for processing your personal data, Article 6(1)(a) GDPR serves as the legal basis for data processing.

Where we process your personal data because this is necessary for performance of a contract or in the context of a quasi-contractual relationship with you, Article 6(1)(b) GDPR serves as the legal basis for data processing.

Where we process your personal data for compliance with a legal obligation, Article 6(1)(c) GDPR serves as the legal basis for data processing.

In addition, Article 6(1)(f) GDPR may come into consideration as a legal basis for data processing if the processing of your personal data is necessary for the purposes of the legitimate interests pursued by our foundation or by a third party, and your interests, fundamental rights and freedoms do not require protection of your personal data.

In this Privacy Policy, we always indicate the legal basis on which we underpin the processing of your personal data.

Erasure of Data and Storage Period
As a matter of principle, we erase or block your personal data whenever the purpose of storage ceases to apply. However, storage may also take place if provision is made for this by legal requirements to which we are liable, such as with regard to statutory storage and documentation obligations. In such a case, we will erase or block your personal data after the requirements cease to apply.

Use of our Online Offer

Use of Cookies
As is the case with many websites, cookies are used for our online offer. Cookies are small text files that are stored on your computer and that save specific settings and data exchange with our online offer via your browser. A cookie will typically contain the name of the domain from which the cookie file was sent, as well as information on the age of the cookie and an alphanumeric identifier.

Cookies enable us to recognise your computer and to make any presettings immediately available. Cookies help us to improve the online offer and enable us to offer you a better service that is tailored more closely to your preferences. This is deemed as our legitimate interest in the processing of data in accordance with Article 6(1)(f) GDPR.

The cookies we use are “session cookies”, which automatically expire at the end of your browser session. Occasionally, cookies with a longer storage period may also be used so that your presettings and preferences can still be taken into account when you next visit our online offer.

Most browsers are set to automatically accept cookies. However, you can disable the storage of cookies or set your browser so that it notifies you as soon as cookies are sent. It is also possible to set your browser to manually delete cookies that have already been stored. Please note that your use of our online offer may, in some circumstances, be limited or restricted if you deny the storage of cookies or delete necessary cookies.

Matomo
We use the open source software program Matomo (formerly Piwik) for our online offer for statistical analysis of its use. Matomo is a web analytics service. The data collected by Matomo are stored in a database for usage analysis purposes, in an effort to optimise our website. This is deemed as our legitimate interest in the processing of data in accordance with Article 6(1)(f) GDPR. The data collected include the shortened IP address, the time, the website requested, the website from which you visited our site (“referrer”), the browser used, the amount of time spent on our website, and the frequency of visits.

The analyses generated using Matomo are rendered completely anonymous and cannot be used to identify individual persons. The data stored by Matomo shall not be linked to other data sources or disclosed to third parties.

Link to opt-out: https://matomo.org/faq/general/faq_20000/

Communication with Us
You can contact us in several different ways, including via the contact form on our website. In addition, we will be happy to provide you with regular information on a variety of topics by sending you our newsletter by email.

Contact Form
If you wish to use the contact form in our online offer, we will record the personal data you enter in the contact form, in particular your name and email address. We will also store the time and the date of your query. We process the data submitted via the contact form exclusively for the purpose of being able to respond to your query or request.

You yourself can decide which information you wish to provide us with via the contact form. The legal basis for the processing of your data is your consent in accordance with Article 6(1)(a) GDPR.

After we have dealt with the matter, the data will initially be stored in case of any queries. A request for the erasure of the data may be made at any time, otherwise they will be erased once the matter has been dealt with fully; statutory retention requirements remain unaffected in each case.

Newsletter
After subscribing to our newsletter, CHE will use your email address for information purposes until you unsubscribe from the newsletter. The newsletter will provide you with regular information on current issues by email, as well as emails for special occasions such as in the case of special actions. These emails may be personalised and individualised, based on the information we have about you.

Where you have not given us your consent in writing, we use the double opt-in method for subscription to our newsletter, i.e. we will only send you a newsletter via email if you have expressly provided us with prior confirmation of your wish that we should activate the newsletter dispatch. We will then send you a notification email, asking you to click on a link contained in this email to confirm that you wish to receive our newsletter.

If you no longer wish to receive any newsletters from us, you may withdraw the consent you gave at any time for future effect or object to the further receipt of the newsletter without incurring any costs other than the cost of transmission at the basic rates. Simply use the unsubscribe link contained in every newsletter or send a message to us or to our Data Protection Officer.

Social Media
You will find links or plug-ins to the social networking sites Facebook, Twitter and Xing in our online offer. You will recognise the links from the corresponding logo of the provider.

Clinking on the links will open the relevant social media sites, which are not covered by this Privacy Policy. Please refer to the relevant privacy policies of the individual providers to find out details about the provisions applicable on their websites; these privacy policies are available at:

Facebook
Twitter
Xing

There will be no transmission of personal data to the relevant provider before using the corresponding link or plug-in. Your visit to the linked website is simultaneously the basis for data processing by the provider in each case.

Use of YouTube
Our online offer contains videos; for the playback of these videos, we use a plug-in of the YouTube (“YouTube”) service, operated by Google. The service is operated by YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. When you visit a website containing a video on our online offer, a connection will be established to the YouTube servers. In light of this, the YouTube server will be informed of the websites on our online offer that you visited.

When you are logged into your YouTube account, you allow YouTube to directly assign your surfing behaviour to your personal profile. You can prevent this by logging off from your YouTube account. For more information on the handling of user data, visit the Google Privacy Policy at https://www.google.de/intl/de/policies/privacy/, which is applicable also to YouTube.

We use YouTube in order to show you videos and to tell you more about us and our projects; this is deemed as our legitimate interest in the processing of data in accordance with Article 6(1)(f) GDPR.

Your Rights; Contact Details
We – CHE – attach great important to explaining the processing of your personal data in the most transparent way possible and to informing you of your rights. If you require more information or if you wish to exercise your rights, you may contact us at any time so that we can take care of your request.

Rights of the Data Subject
You have extensive rights with regard to the processing of your personal data. First of all, you have an extensive right of access and may, where applicable, request that your personal data are rectified and/or erased or blocked. You may also request the restriction of processing, and you have a right to object to processing. You also have a right to data portability with regard to the personal data you have communicated to us.

If you wish to assert your rights and/or obtain more information about this, please contact our staff via the contact form. Alternatively, you may also contact our Data Protection Officer.

Withdrawal of Consent; Objection
Any consent you have given may be freely withdrawn at any time for future effect. By withdrawing consent, the legitimacy of processing that took place on the basis of consent until its withdrawal is not affected. With regard to this, please also contact our staff via the contact form or our Data Protection Officer.

If processing of your personal data is not based on consent, but on another legal basis, you may object to this data processing. Your objection will result in a review and, where applicable, the cessation of data processing. You will be informed of the outcome of the review and – where data processing is to be continued nevertheless – will receive from us more information as to why data processing is permissible.

Data Protection Officer and Contact Details
We have appointed an external Data Protection Officer who provides us with support in issues relating to data protection; you may also contact the Data Protection Officer directly. Our Data Protection Officer is available to answer any questions you may have regarding our handling of personal data or any other information you may require on issues relating to data protection:
Email: datenschutz@che.de

Complaints
If you are of the opinion that our processing of your personal data is inconsistent with this Privacy Policy or the applicable data protection regulations, you may lodge a complaint with our Data Protection Officer. The Data Protection Officer will then look into the matter and inform you of the outcome of the review. You also have the right to lodge a complaint with a supervisory authority.

More Information and Amendments

Links to other Websites
Our online offer may contain links to other websites. These links are usually marked as such. We have no influence on the extent to which the linked websites comply with the applicable data protection regulations. We therefore recommend that you check out the privacy policies of the other websites in each case.

Amendments to this Privacy Policy
The status of this Privacy Policy is indicated by the date (specified at the bottom). We reserve the right to amend this Privacy Policy at any time with future effect. It will be amended in particular in the case of technical adaptations to the online offer or where data protection requirements are amended. The up-to-date version of the Privacy Policy will always be available directly via the online offer. We recommend that you periodically check out any amendments to this Privacy Policy.

Status of this Privacy Policy: May 2018