Privacy

General information about the processing of your data

We are obliged by law to inform you about the processing of your personal data (hereinafter referred to as data) when you use our website. We take the protection of your personal data very seriously. This privacy statement informs you about the details of the processing of your data and about your legal rights in this regard. For terms such as “personal data” and “processing”, the legal definitions pursuant to Art. 4 GDPR apply. We reserve the right to adapt the privacy statement with future effect, in particular in the event of further development of the website, the use of new technologies or changes to the legal bases or the corresponding case law. We recommend that you read this privacy statement from time to time and take a printout or a copy for your records.

Scope

This privacy statement applies to all pages of www.hhl.de. It does not cover any linked websites of other providers.

Controller

The following party is known as the controller under data protection law and therefore responsible for the processing of personal data within the scope of this privacy statement:

HHL gemeinnützige GmbH
Jahnallee 59, 04109 Leipzig
Phone: +49 341 9851-60
Email: info@hhl.de

Questions about data protection

If you have any questions about data protection with regard to our company or our website, you can contact our data protection officer:

MGID
Mitteldeutsche Gesellschaft für Informationssicherheit und Datenschutz mbH
Lars Nöcker
Mozartstraße 10, 04107 Leipzig
Phone: +49 341 96273553
email: datenschutz@hhl.de

Security

We have taken comprehensive technical and organizational precautions to protect your personal data from unauthorized access, abuse, loss and other external disruption. To this end, we regularly review our security measures and adapt them to the latest standards.

Your rights

You have the following rights with regard to the personal data concerning you that you can assert against us:

Right of access: You can request access to the personal data concerning you which we process, as set forth in Art. 15 GDPR.
Right to rectification: If the information concerning you is not (or no longer) correct, you can request its rectification in accordance with Art. 16 GDPR. If your data is incomplete, you can request that it be completed.
Right to erasure: You may request the erasure of your personal data in accordance with Art. 17 GDPR.
Right to restriction of processing: Pursuant to Art. 18 GDPR, you have the right to demand that the processing of your personal data be restricted.
Right to object to processing: Pursuant to Art. 21(1) GDPR, you have the right to object at any time, for reasons arising from your particular situation, to the processing of your personal data which occurs based on Art. 6(1) Sentence 1(e) or (f) GDPR. If you object, we will not process your data further, unless we can prove compelling legitimate reasons for the processing which override your interests, rights and freedoms or, moreover, the processing serves to establish and exercise or defend legal claims (Art. 21(1) GDPR). Furthermore, under Art. 21(2) GDPR you have the right to object at any time to the processing of your personal data for direct marketing purposes, which includes profiling to the extent that this is related to such direct marketing. In this privacy statement, we draw your attention to this right to object when describing each processing operation.
Right to withdraw your consent: If you have given your consent for processing, you have a right to withdraw that consent under Art. 7(3) GDPR.
Right to data portability: You have the right to receive the personal data you have given us in a structured, commonly used, machine-readable format (“data portability”) and the right to transfer this data to another controller, if the prerequisites of Art. 20(1)(a), (b) GDPR are fulfilled (Art. 20 GDPR).

You can assert your rights by informing us using the contact details specified under “Controller” above or by contacting the data protection officer designated by us.

If you believe that the processing of your personal data violates data protection law, then under Art. 77 GDPR you also have the right to lodge a complaint with a data protection supervisory authority of your choice. This also includes the data protection supervisory authority responsible for the controller: Saxon Commissioner for Data Protection, Postfach 110132, 01330 Dresden, +49351/85471 101, saechsdsb@slt.sachsen.de.

Using our website

In principle, you can use our website for purely informational purposes without disclosing your identity. When you access the individual pages of the website in this sense, this only results in access data being transferred to our web hosting service so that the website can be displayed to you. This involves the following data being processed:

Browser type/browser version
Operating system used
Language and version of the browser software
Date and time of access
Hostname of the accessing device
IP address
Content of the request (specific page)
Access status / HTTP status code
Websites accessed via the website
Referrer URL (website visited before)
Notification of whether the access was a success and
Volume of data transferred.

It is necessary for this data to be processed temporarily in order to make it technically possible for you to visit our website and deliver the website to your device. The access data is not used to identify individual users and is not combined with other data sources. The data is also stored in log files, in order to ensure the functionality of the website and the security of the information technology systems. The legal basis for the processing is Art. 6(1) Sentence 1(f) GDPR. We have legitimate interests in ensuring the functionality, integrity and security of the website. Storing access data in log files, in particular the IP address, for a longer period of time enables us to detect and prevent misuse. This includes, for example, defending against requests that would overload the service as well as against bots. The access data will be erased as soon as it is no longer required for achieving the purpose of its processing. In the case of recording the data to provide the website, this is the case when you end your visit to the website. The log data is generally stored directly and in such a way that it can only be accessed by administrators, and it is erased after ten days at the latest. After that, it is only indirectly available by reconstructing backups and is finally erased after a maximum of four weeks.

You may object to the processing. Your right of objection exists if you have reasons arising from your particular situation. You may send us your objection using the contact details specified under “Controller” above.

Tracking

In addition to the aforementioned access data, cookies, pixels or other tracking technologies are used when you use the website. Cookies are small text files with a sequence of numbers that are stored locally in the cache of the browser used. Pixels are single-pixel images that blend in visually with the website and are therefore not visible to the user. The pixel also collects information about your behavior as a user on the website. Fingerprinting technologies create a unique fingerprint based on browser settings and thus identify an individual browser. By means of a script that every internet browser automatically executes, it can sometimes be possible to collect information such as screen resolution, fonts used, the operating system, hardware information and integrated browser plug-ins, which in their specific combination can ultimately be traced back to a specific user. Tracking technologies serve to make our website user-friendly. The use of tracking technologies may be technically necessary or may occur for other purposes (e.g. analysis/evaluation of website use).

Technically necessary elements

Some elements of our website require that it be possible to identify the retrieving browser even after a page change. In the technically necessary elements, such as in particular cookies or similar methods of accessing devices, data is also processed for the purpose of carrying out or facilitating electronic communication and providing an information society service requested by the user.

The user data collected by technically necessary elements is not processed to create user profiles. The legal basis for this processing is Art. 6(1) Sentence 1(f) GDPR. Our legitimate interests in the processing lie in providing the aforementioned special functionality and thereby making the use of our website more attractive and effective.

Technically non-essential tracking

In addition, we also use cookies, pixels, browser fingerprinting and other tracking technologies on the website to enable an analysis of users’ surfing behavior. For example, this involves storing and processing the following data:

Frequency of page views
Use of website features.

The legal basis for this processing is your consent under Art. 6(1) Sentence 1(a) GDPR. The technically non-essential cookies, pixels and other tracking technologies are automatically erased after a specified period, which may vary depending on the tracking method. Where we integrate cookies from third-party providers, pixels, and similar tracking technologies into our website, we point this out to you separately below.

You can withdraw your consent to the processing by the provider in question at any time by moving the slider back in the Consent Tool. Please note that this will not affect the lawfulness of the processing before your withdrawal.

Borlabs Cookie consent management platform

To make it easier for us to ask for your consent to the use of cookies or other tracking technologies so that we can process your device information and personal data when you visit our website, we use the consent tool “Borlabs Cookie”. Borlabs Cookie gives you the opportunity to accept or decline the processing of your device information and personal data using cookies or other tracking technologies for the purposes listed in Borlabs Cookie. Such processing purposes may include the integration of external elements, integration of streamed content, statistical analysis, reach measurement, personalized product recommendations, and personalized advertising. You can use Borlabs Cookie to grant or refuse your consent for all processing purposes, or to grant or refuse your consent for individual purposes or third-party providers. You can change your settings again later on. To do this, go to https://www.hhl.de/privacy/ and select “Open and change privacy settings for this website”. The purpose of integrating Borlabs Cookie is to allow users of our website to decide whether to allow cookies and similar technologies and to offer them the opportunity to change settings that they have already made when they continue to use our website. When Borlabs Cookie is used, we process personal data as well as information from the devices used. This also involves sending your data to Borlabs Cookie (Borlabs GmbH, Rübenkamp 32, 22305 Hamburg, Germany). The information about the settings you have made is also stored on your device. The legal basis for the processing is Art. 6(1) Sentence 1(c) GDPR in conjunction with Art. 7(1) GDPR, insofar as the processing serves to fulfill the legally standardized obligations to provide evidence for the granting of consent. Otherwise, Art. 6(1) Sentence 1(f) GDPR is the relevant legal basis. Our legitimate interests in this processing lie in the storage of users’ settings and preferences with regard to the use of cookies and the evaluation of consent rates. A new request for your consent will be made twelve months after you saved your user settings. Your user settings will then be saved again for this period, unless you delete the information about your user settings yourself beforehand in your device settings.

You may object to the processing, insofar as processing is based on Art. 6(1) Sentence 1(f) GDPR. Your right of objection exists if you have reasons arising from your particular situation. You may send us your objection using the contact details specified under “Controller” above.

Caching with NitroPack

We also use the caching services of NitroPack Ltd. (3 Prof. Georgi Bradistilov, entr. A, 3rd floor, Sofia, Bulgaria; hereinafter referred to as: NitroPack) on our website in order to make retrieving and loading the website faster. The combination of cache validation and CDN delivery ensures a seamless user experience. The legal basis for the processing is Art. 6(1) Sentence 1(f) GDPR. By using NitroPack, we are pursuing our legitimate interest in faster website retrieval as well as more efficient and improved website loading times. For further information about the protection of your data and how long NitroPack stores your data, please refer to: Privacy Policy (nitropack.io)

Contacting our company

When you contact our company, e.g. by email or using the contact form on the website, we will process the personal data you provide so that we can respond to your request. In order for us to process enquiries submitted via the contact form on the website, it is essential that you provide your salutation, first and last name, a valid email address, your country and city of residence, and tell us which program you are interested in. At the time the message is sent to us, the date and time of registration will be processed. The legal basis for this processing is Art. 6(1) Sentence 1(f) GDPR and Art. 6(1) Sentence 1(b) GDPR, if the contact is made with the intention of concluding a contract. If the request is aimed at concluding a contract, it is necessary for you to provide your data in order to conclude a contract. If you do not provide your data, it will not be possible to conclude or execute a contract (in the form of establishing contact or processing the request). Processing the personal data from the form serves the sole purpose of processing the contact you make with us. Where you contact us by email, this also constitutes the necessary legitimate interest in the processing of the data. The other data processed during the submission process serves to prevent any misuse of the contact form and to ensure the security of our information technology systems. In this context, the data you entered will be transferred to our management software. Please refer to the “Management software” section for more detailed information. When the processing is no longer necessary, if applicable we will restrict the processing in order to comply with our statutory retention obligations.

Free information services

Our website offers a variety of free information material / brochures. If you wish to receive such information material / brochures, it is essential that you provide your salutation, first and last name, a valid email address, your country and city of residence, and tell us which program you are interested in. At the time the message is sent to us, the date and time of registration will be processed. The legal basis for the processing is Art. 6(1) Sentence 1(f) GDPR or Art. 6(1) Sentence 1(b) GDPR, if the request for information material / brochures is made with the intention of concluding a contract. If the request is aimed at concluding a contract, it is necessary for you to provide your data in order to conclude a contract. If you do not provide your data, it will not be possible to conclude or execute a contract (in the form of establishing contact or processing the request). We will process the personal data you enter in the form in order to send you the free information material. The other data processed during the submission process serves to prevent any misuse of the form and to ensure the security of our information technology systems. In this context, the data you entered will be transferred to our management software. Please refer to the “Management software” section for more detailed information. When the processing is no longer necessary, if applicable we will restrict the processing in order to comply with our statutory retention obligations.

CV check

We offer a free CV checking service on our website. This is intended to assist you in choosing the right degree program and checking the admission requirements. When requesting that we check your CV, it is essential that you include your CV, tell us which program you are interested in, select a field of studies, and provide a salutation, your first and last name, and a valid email address. The legal basis for the processing is Art. 6(1) Sentence 1(f) GDPR and Art. 6(1) Sentence 1(b) GDPR, if the contact is made with the intention of concluding a contract. If the request is aimed at concluding a contract, it is necessary for you to provide your data in order to conclude a contract. If you do not provide your data, it will not be possible to conclude or execute a contract (in the form of establishing contact or processing the request). We will process the personal data you enter in the form for the purpose of preparing your personalized feedback in order to recommend suitable degree programs. The other data processed during the submission process serves to prevent any misuse of the CV check form and to ensure the security of our information technology systems. In this context, the data you entered will be transferred to our management software. Please refer to the “Management software” section for more detailed information. When the processing is no longer necessary, if applicable we will restrict the processing in order to comply with our statutory retention obligations.

Registering for an event

On our website it is possible to register for our events. When doing so, you are required to indicate which event you would like to register for, which program you are interested in, and provide a salutation, a first and last name, a valid email address, and a country and city of residence. The legal basis for the processing is Art. 6(1) Sentence 1(f) GDPR and Art. 6(1) Sentence 1(b) GDPR, if the contact is made with the intention of concluding a contract. If the request is aimed at concluding a contract, it is necessary for you to provide your data in order to conclude a contract. If you do not provide your data, it will not be possible to conclude or execute a contract (in the form of establishing contact or processing the request). Processing the personal data from the form serves the purpose of registering you for the event. The other data processed during the submission process serves to prevent any misuse of the form and to ensure the security of our information technology systems. In this context, the data you entered data will be transferred to our management software. Please refer to the “Management software” section for more detailed information. When the processing is no longer necessary, if applicable we will restrict the processing in order to comply with our statutory retention obligations.

Management software (Pardot)

We use Pardot, a marketing automation tool provided by Salesforce (Salesforce.com, Inc. Salesforce Tower, 415 Mission Street, 3rd Floor, San Francisco, CA 94105, US, hereinafter referred to as: Salesforce). This involves storing the data which you provided when using the forms on our website, and creating a user profile within the management software for the purpose of coordinating and responding to your enquiry. The legal basis for this processing is Art. 6(1) Sentence 1(f) GDPR. We have legitimate interests in effectively coordinating and responding to our customer enquiries as well as in administering and managing prospective customers. When the processing is no longer necessary, if applicable we will restrict the processing in order to comply with our statutory retention obligations. Salesforce also processes your data in the US. There is no European Commission adequacy decision for the US. So-called standard contractual clauses have been concluded with Salesforce to ensure that an appropriate level of data protection is maintained. A copy of the standard contractual clauses is available on request. For further information about the protection of your data and how long Salesforce stores your data, please refer to: https://www.salesforce.com/de/company/privacy/

We also use the Pardot service to analyze databases (lead generation), to measure our marketing spend and to improve our services. Pardot uses cookies (see “Tracking” above), which are stored on your device. Pardot uses the cookies to process the information generated about the use of our website and the forms by your device – e.g. the fact that you have visited a certain page – and processes, among other things, the data mentioned under “Using our website”, in particular your IP address, browser information, the website visited before and the date and time of the server request, for the purpose of statistical analysis of how people use our website. Pardot will process this information for the purpose of evaluating your use of our website. If users fill out a form on our website, this data is processed in Pardot and Pardot can associate the visit with an existing user profile. The legal basis for this processing is your consent under Art. 6(1) Sentence 1(a) GDPR. Salesforce also processes the data in part in the US. The EU Commission has not issued an adequacy decision for data transfers to the US; the legal basis for transfers to the US is your consent under Art. 49(1) Sentence 1(a) GDPR. Your data processed in connection with Pardot will be erased after fourteen months at the latest. For further information about privacy at Salesforce, please refer to: https://www.salesforce.com/company/privacy/full_privacy/#nav_info

Processing for contractual purposes

We process your personal data if and to the extent necessary for the initiation, creation, execution and/or termination of a legal transaction with our company. The legal basis for this results from Art. 6(1) Sentence 1(b) GDPR. It is necessary for you to provide your data in order to conclude the contract and you are contractually obliged to provide your data. If you do not provide your data, it will not be possible to conclude and/or execute a contract. Once the purpose has been achieved (e.g. contract processing), the personal data will be blocked for further processing or erased, unless we are entitled to keep processing the data on the basis of a consent granted by you (e.g. consent to the processing of your email address for sending promotional emails), a contractual agreement, a statutory authorization (e.g. authorization to send direct marketing) or on the basis of justified interests (e.g. retention for asserting claims).

Your personal data will be passed on to third parties if

It is necessary for the creation, execution or termination of legal transactions with our company (e.g. when transmitting data to a payment service provider / a shipping company to process a contract with you) (Art. 6(1) Sentence 1(b) GDPR), or
A subcontractor or party we use to perform our obligations, which we use exclusively within the framework of providing the offers or services requested by you, needs this data (unless you are expressly informed otherwise, such auxiliary parties are only entitled to process the data insofar as this is necessary for the provision of the offer or service), or
There is an enforceable official order (Art. 6(1) Sentence 1(c) GDPR), or
There is an enforceable court order (Art. 6(1) Sentence 1(c) GDPR), or
We are legally obliged to do so (Art. 6(1) Sentence 1(c) GDPR), or
The processing is necessary in order to protect the vital interests of the data subject or another natural person (Art. 6(1) Sentence 1(d) GDPR), or
This is necessary for the performance of a task carried out in the public interest or in the exercise of official authority (Art. 6(1) Sentence 1(e) GDPR), or
We can cite our overriding legitimate interests, or those of a third party, in the disclosure (Art. 6(1) Sentence 1(f) GDPR).

Your personal data will not be transmitted to other persons, companies or bodies unless you have effectively consented to such transmission. The legal basis for the processing is then Art. 6(1) Sentence 1(a) GDPR. In this privacy statement, we draw your attention to the respective recipients when describing each processing operation.

Email marketing

You have the possibility to subscribe to our email newsletter on the website, which we use to inform you regularly about the following content:

Interesting aspects from our portfolio, especially concerning highlights, innovations and specifications from certain degree programs
Limited-time offers (Early Bird Deadlines)
Information and invitations to events
New offers and information on services concerning the degree programs
Individual guidance on degree programs.

The newsletter can be subscribed to as part of the contact form, during the CV checking service, when ordering information material / brochures, when registering for events and in particular when registering for free webinars, when registering to receive guides / white papers and other free online offers. It is mandatory that you provide the data specified in the respective form. We process this data for the purpose of sending our email newsletter and for as long as you have subscribed to the newsletter.

We use external email marketing services to send the newsletter. For more information about these service providers, please refer to the section “Email marketing services”.

The legal basis for the processing is Art. 6(1) Sentence 1(a) GDPR.

You can withdraw your consent to the processing of your email address for the purpose of sending you the newsletter at any time, either by clicking directly on the unsubscribe link in the newsletter or by sending us a message using the contact details provided under “Controller”. This will not affect the lawfulness of the processing carried out on the basis of the consent prior to the withdrawal.

In order to document your newsletter registration and to prevent abuse of your personal data, we use what is known as a double opt-in procedure for email newsletter registrations. Once you have submitted the form, we will send you an email to the email address you have provided, in which we ask you to expressly confirm your subscription to the newsletter by clicking on a confirmation link. We process your IP address, the date and time of your registration for the newsletter and the time of your confirmation. This is how we ensure that you really want to receive our email newsletter. We are legally obliged to be able to demonstrate that you have consented to the processing of your personal data in connection with registering for the newsletter (Art. 7(1) GDPR). Due to this legal obligation, this data processing is carried out on the basis of Art. 6(1) Sentence 1(c) GDPR.

If you do not confirm your newsletter subscription within 24 hours, we will not use your data to send you the newsletter. The data will then only be used for the purpose of the respective form. Once you confirm your registration, we will process your data for as long as you have subscribed to the newsletter.

If you cancel your registration by withdrawing your consent, we will continue to process your data, in particular your email address, to ensure that you do not receive any more newsletters from us. For this purpose, we will add your email address to an opt-out list, which makes it possible to prevent you from receiving any more newsletters from us. The legal basis for the data processing is Art. 6(1) Sentence 1(c) GDPR, in order to comply with our obligations to provide evidence, and failing this, Art. 6(1) Sentence 1(f) GDPR. In this case, we have a legitimate interest in complying with our legal obligations to make sure that we stop sending you newsletters.

We will also process the aforementioned data for the establishment, exercise or defense of legal claims. The legal basis for this processing is Art. 6(1) Sentence 1(c) GDPR and Art. 6(1) Sentence 1(f) GDPR. In these cases, we have a legitimate interest in the assertion or defense of claims.

Email marketing services

We use the following email marketing services:

Mailchimp, provided by The Rocket Science Group, LLC, 675 Ponc de Leon Ave NE, Suite 5000, Atlanta, GA 30308 US; hereinafter referred to as: Mailchimp); Mailchimp also processes your data in the US. No EU Commission adequacy decision exists for data transfers to the US. So-called standard contractual clauses have been concluded with Mailchimp to ensure that an appropriate level of data protection is maintained. A copy of the standard contractual clauses is available on request. For more information, please refer to Mailchimp’s privacy statement at: https://mailchimp.com/legal/privacy/
Pardot, provided by Salesforce.com, Inc (Salesforce Tower, 415 Mission Street, 3rd Floor, San Francisco, CA 94105, US); Salesforce also processes your data in the US. No EU Commission adequacy decision exists for data transfers to the US. So-called standard contractual clauses have been concluded with Salesforce to ensure that an appropriate level of data protection is maintained. A copy of the standard contractual clauses is available on request. For more information about the storage period, please refer to the Salesforce privacy policy at: https://www.salesforce.com/de/company/privacy/

If you have subscribed to the newsletter, the data provided when registering as well as the data processed when you use our newsletters are processed on the servers of our aforementioned email marketing services. Each email marketing service acts as our processor and is contractually limited in its authority to use your personal data for purposes other than to provide services to us in accordance with the applicable data processing agreement.

The legal basis for the processing is Art. 6(1) Sentence 1(f) GDPR. Our legitimate interest in using an external email marketing service lies in the optimization and more targeted control and monitoring of our newsletter content.

Integration of third-party content

The website integrates third-party content such as videos, maps and graphics from other websites. This integration always requires that the providers of this content (“third-party providers”) perceive the IP addresses of users. This is because without the IP address they would not be able to send the content to the browser of the respective user. As such, the IP address is required to display this content. In the following, we inform you about the services from external providers currently in use on our website, about the related processing in each case, and about how you can object or withdraw your consent.

Google Tag Manager

Our website uses Google Tag Manager, which is provided by Google (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, fax: +353 (1) 436 1001). Google Tag Manager is a solution that allows website tags and other elements to be managed through a single interface.

Firstly, when you visit the website with Google Tag Manager, an HTTP request is sent to Google. As a result, device information and personal data – such as your IP address and information about your browser settings – are transmitted to Google. We use Google Tag Manager to facilitate electronic communications by providing information to third-party providers, including through programming interfaces. Google Tag Manager implements the respective tracking codes of the third-party providers without us having to go to the effort of changing the source code of the website ourselves. Instead, integration is performed by a container that places what is known as placeholder code in the source code. Google Tag Manager also enables the exchange of users’ data parameters in a certain order, in particular by ordering and systematizing the data packets. In isolated cases, your data will also be transferred to the US. So-called standard contractual clauses have been concluded with Google to ensure that an appropriate level of data protection is maintained. A copy of the standard contractual clauses is available on request. The legal basis for this processing is Art. 6(1) Sentence 1(f) GDPR. We have legitimate interests in the processing for the purposes of facilitating and carrying out electronic communication by identifying communication endpoints, control options, exchanging data elements in a defined order, and identifying transmission errors. Google Tag Manager does not initiate data storage. For further information about privacy at Google, please refer to: http://www.google.de/intl/en/policies/privacy

You may object to the processing, insofar as processing is based on Art. 6(1) Sentence 1(f) GDPR. Your right of objection exists if you have reasons arising from your particular situation. You can prevent the processing by deleting the browser history and other website data in your browser settings or by opening your browser in “private mode”.

On the other hand, Google Tag Manager integrates tags from third-party providers, such as tracking codes or tracking pixels, on our website. The tool triggers other tags, which in turn record your data; our privacy statement explains this separately in each case. Google Tag Manager itself does not evaluate the device information and personal data of users collected by the tags. Rather, your data is forwarded to the specific third-party service for the purposes specified in our consent management tool. We have configured Google Tag Manager to work with our consent management tool in such a way that triggering certain third-party services in Google Tag Manager depends on the selections you make in our consent management tool, so that only those tags from third-party providers trigger data processing for which you have given consent. The use of Google Tag Manager is subject to your consent for the specific third-party service. The legal basis for this processing is your consent under Art. 6(1) Sentence 1(a) GDPR. Google also processes the data in part in the US. The EU Commission has not issued an adequacy decision for data transfers to the US; the legal basis for transfers to the US is your consent under Art. 49(1) Sentence 1(a) GDPR. The following descriptions of the individual third-party services specify how long your data will be stored in each case. For further information about privacy at Google, please refer to: http://www.google.de/intl/en/policies/privacy

Unibuddy chat

We use the chat service provided by Unibuddy (Unibuddy UK, 15 Westland Pl, Hoxton, London N1 7NP) to enable direct contact between graduates and prospective students. In order to use the chat function, the user must set up a Unibuddy account. Unibuddy saves the data entered, such as first and last name, email address and a password of your choice. In addition, chat conversations and interactions with student ambassadors are processed. For the purposes of administering and improving processes, including troubleshooting, data analysis, testing, research, pseudonymized statistics and surveys, device information is processed and personal data of users such as your IP address and information about browser settings is transmitted to Unibuddy. The legal basis for the processing is Art. 6(1) Sentence 1(f) GDPR and Art. 6(1) Sentence 1(b) GDPR, if the contact is made with the intention of concluding a contract. If the request is aimed at concluding a contract, it is necessary for you to provide your data in order to conclude a contract. If you do not provide your data, it will not be possible to conclude or execute a contract (in the form of establishing contact or processing the request). The other data processed during the submission process serves to prevent any misuse of the form and to ensure the security of our information technology systems. Our legitimate interests in the processing lie in enhancing and optimizing our services and exchanging information with potential students. In isolated cases, your data will also be transferred to the United Kingdom. The EU has issued an adequacy decision for data transfers to the United Kingdom. Further information about the purpose and scope of processing by Unibuddy and the storage period can be found at: https://unibuddy.com/privacy-policy/

Feedyou chatbot

We use the chatbot provided by Feedyou (Feedyou s.r.o., V Ráji 919, 530 02 Pardubice, Czech Republic). The chatbot is a means of providing the user with information about the full-time MBA program. The text entered by the user is processed by Feedyou. For the purposes of administering and improving processes, including troubleshooting, data analysis, testing, research, pseudonymized statistics and surveys, device information is processed and personal data of users such as your IP address and information about browser settings is transmitted to Feedyou. The legal basis for the processing is Art. 6(1) Sentence 1(f) GDPR and Art. 6(1) Sentence 1(b) GDPR, if the contact is made with the intention of concluding a contract. If the request is aimed at concluding a contract, it is necessary for you to provide your data in order to conclude a contract. If you do not provide your data, it will not be possible to conclude or execute a contract (in the form of establishing contact or processing the request). The other data processed during the submission process serves to prevent any misuse of the form and to ensure the security of our information technology systems. Our legitimate interests in the processing lie in enhancing and optimizing our services and exchanging information with potential students. Further information about the purpose and scope of processing by Feedyou and the storage period can be found at: https://feedyou.ai/privacy-security/ and https://feedyou.ai/privacy-policy/

YouTube videos

Our website uses plug-ins from the video platform YouTube.de or YouTube.com, a service provided by YouTube LLC (head office at 901 Cherry Avenue, San Bruno, CA 94066, US; hereinafter referred to as: YouTube), for which Google (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, fax: +353 (1) 436 1001) is responsible as the controller under data protection law. We use this processing of data by the plug-ins to pursue the purpose of integrating visual content (videos) on the website that we have published on YouTube.de or YouTube.com. When videos are played on our website, YouTube receives the information that you have retrieved the corresponding page of our website. In addition, some of the data mentioned under “Using our website” is transmitted to Google. This occurs regardless of whether YouTube provides a user account that you are logged in with or whether no user account exists. If you are logged in to Google, your data will be directly associated with your account. If you do not wish for this data to be associated with your YouTube profile, you must log out before activating the button. YouTube stores your data as user profiles and processes it, regardless of whether you have a Google account, for the purposes of advertising, market research and/or the demand-oriented design of its website. The legal basis for this processing is your consent under Art. 6(1) Sentence 1(a) GDPR. Google also processes the data in part in the US. No EU Commission adequacy decision exists for data transfers to the US. The legal basis for the transfer to the US is your consent pursuant to Art. 49(1) Sentence 1(a) GDPR. For more information about the purpose and scope of data processing by YouTube and how long YouTube stores such data, please refer to the privacy information at: https://policies.google.com/privacy

Services for statistical, analysis and marketing purposes

We use services from third parties for statistical, analysis and marketing purposes. This enables us to offer you a user-friendly, optimized experience when visiting the website. The third-party providers use cookies, pixels, browser fingerprinting or other tracking technologies to control their services. In the following, we inform you about the services from external providers currently in use on our website, about the related processing in each case, and about how you can withdraw your consent.

Google Analytics

In order to tailor our website perfectly to user interests, we use Google Analytics, a web analytics service from Google (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, fax: +353 (1) 436 1001). Google Analytics uses cookies (see “Cookies” above), which are stored on your device. Google uses the cookies to process the information generated about the use of our website by your device – e.g. the fact that you have visited a certain page – and process, among other things, the data mentioned under “Using our website”, in particular your IP address, browser information, the website visited before and the date and time of the server request, for the purpose of statistical analysis of how people use our website. For this purpose, it is also possible to determine whether different devices belong to you or to your household. This website uses Google Analytics with the “anonymizeIp()” extension. This shortens IP addresses before they are processed, in order to make it much more difficult to identify individuals. According to Google, your IP address is shortened beforehand within member states of the European Union. Only in exceptional cases will the full IP address be transferred to a Google server in the US and shortened there. Google will process this information for the purpose of evaluating your use of this website, compiling reports for us on website activity, and – where we point this out separately – providing us with other services relating to website usage. If a user is registered with a Google service, Google can associate the visit with the user’s account and create and evaluate user profiles across applications.

We also use Google Analytics for the purpose of analyzing databases (lead generation) and measuring our marketing spend from various marketing channels. For this purpose, we use the services of GA Connector (Zuev Software LLC, Akademika Lebedeva Street 1/6, Kyiv, Ukraine). This enables us to integrate the aforementioned Google Analytics data into our CRM system (see “Management software (Pardot)”) from Pardot (Salesforce.com, Inc. Salesforce Tower, 415 Mission Street, 3rd Floor, San Francisco, CA 94105, US). The legal basis for this processing is your consent under Art. 6(1) Sentence 1(a) GDPR. When consenting to the use of Google Analytics, this also includes the combination of usage data in Pardot by means of GA Connector. Google, GA Connector and Pardot also process the data in part in the US. No EU Commission adequacy decision exists for data transfers to the US or Ukraine. The legal basis for the transfer to the US and Ukraine is your consent pursuant to Art. 49(1) Sentence 1(a) GDPR. Your data processed in connection with Google Analytics will be erased after twenty-six months at the latest. For further information about privacy at Google, please refer to: http://www.google.de/intl/de/policies/privacy; for GA Connector: https://gaconnector.com/about-us/privacy-policy.php; and for Pardot: https://www.salesforce.com/company/privacy/full_privacy/#nav_info

Google Ads Remarketing

We use Google Ads with the Dynamic Remarketing feature, which is a tool provided by Google (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, fax: +353 (1) 436 1001). This is a process we use in an attempt to contact you again. The Dynamic Remarketing feature allows us to recognize users of our website on other websites within the Google advertising network (in Google Search or on YouTube, so-called Google Ads, or on other websites) and present ads tailored to their interests. Ads may also refer to products and services that you have already viewed on our website. For this purpose, analyses are performed of user interactions on our website, e.g. which offers a user was interested in, so that we can display targeted advertising to users on other sites after they have left our website. When you visit our website, Google Ads stores a cookie on your device. Google uses cookies to process the information generated by your device about the use of our website and interactions with our website as well as the data mentioned under “Using our website”, in particular your IP address, browser information, the website visited before and the date and time of the server request, for the purpose of deploying personalized ads. For this purpose, it is also possible to determine whether different devices belong to you or to your household. If a user is registered with a Google service, Google can associate the visit with the user’s account and create and evaluate user profiles across applications. The legal basis for this processing is your consent under Art. 6(1) Sentence 1(a) GDPR. Google also processes the data in part in the US. No EU Commission adequacy decision exists for data transfers to the US. The legal basis for the transfer to the US is your consent pursuant to Art. 49(1) Sentence 1(a) GDPR. The maximum storage period with Google is thirteen months. For further information about the protection of your data and how long Google stores your data, please refer to: https://policies.google.com/privacy

Google Ads Conversion

We use Google Ads, which is a service provided by Google (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, fax: +353 (1) 436 1001), in order to use ads (formerly known as Google AdWords) to draw attention to our services on external websites. In relation to the data of the advertising campaigns, we can determine how successful the individual advertising activities are. These ads are delivered by Google via so-called ad servers. For this purpose, we use ad server cookies, which can be used to measure certain parameters for reach measurement, such as the display of ads or clicks by users. If you reach our website via a Google ad, Google Ads stores a cookie on your device. Google uses the cookies to process the information generated by your device about interactions with our ads (retrieval of a particular web page or clicking on an ad), and the data mentioned under “Using our website” – in particular the IP address, browser information, the website visited before and the date and time of the server request – for the purpose of analyzing and visualizing the reach measurement of our ads. For this purpose, it is also possible to determine whether different devices belong to you or to your household. Due to the marketing tools used, your browser automatically establishes a direct connection to the Google server. If you are registered with a Google service, Google can associate the visit with your account. Even if you are not registered with Google or have not logged in, it is possible that the provider will obtain and process your IP address. We only receive statistical analyses from Google for the purpose of measuring the success of our ads. The legal basis for this processing is your consent under Art. 6(1) Sentence 1(a) GDPR. Google also processes the data in part in the US. No EU Commission adequacy decision exists for data transfers to the US. The legal basis for the transfer to the US is your consent pursuant to Art. 49(1) Sentence 1(a) GDPR. The maximum storage period with Google is twenty-four months. For further information about the protection of your data and how long Google stores your data, please refer to: https://policies.google.com/privacy

Facebook Analytics

We use the Facebook tool Facebook Analytics. The provider is Facebook Ireland Limited (4 Grand Canal Square, Dublin 2, Ireland, email: impressum-support@support.facebook.com; hereinafter referred to as: Facebook). In order to use Facebook Analytics, we use so-called Facebook pixels for the purpose of analyzing how people use our website and online presences, e.g. on the social networks Facebook and Instagram, how users interact with our website and online presences, and measuring the reach of our ads. Your browser uses Facebook pixels – small graphics that are also embedded on our website, are automatically loaded when you visit our website, and enable tracking of user behavior – to automatically establish a direct connection with the Facebook server. Embedding Facebook pixels allows Facebook to process the information generated by cookies about the use of our website by your device – e.g. the fact that you have visited a certain page – and process, among other things, the data mentioned under “Using our website”, in particular your IP address, browser information, the website visited before, the Facebook ID and the date and time of the server request, for the purposes of analyzing our website and other online presences, analyzing user interactions and measuring the reach of our ads. For these purposes, it is also possible to determine whether different devices belong to you or to your household. The information we obtain with the help of Facebook pixels serves statistical purposes only, is transmitted to us by Facebook in the form of anonymous statistics, and does not provide any personal information about users. If you are registered with a Facebook service, Facebook can associate the information recorded with your account. Even if a user is not registered with Facebook or has not logged in, it is possible that Facebook will obtain and process their IP address and other identifying information. Your personal data will be processed on the basis of your consent pursuant to Art. 6(1) Sentence 1(a) GDPR. Facebook also processes the data in part in the US. No EU Commission adequacy decision exists for data transfers to the US. The legal basis for the transfer to the US is your consent pursuant to Art. 49(1) Sentence 1(a) GDPR. The information in Facebook cookies will be stored for a maximum of three months. For further information about the protection of your data and how long Facebook stores your data, please refer to: https://www.facebook.com/privacy/explanation and https://www.facebook.com/policies/cookies/

Facebook Custom Audiences

The website also uses Facebook’s “Website Custom Audiences” feature. The provider is Facebook Ireland Limited (4 Grand Canal Square, Dublin 2, Ireland, email: impressum-support@support.facebook.com; hereinafter referred to as: Facebook). So-called web beacons, such as the “Facebook pixel”, are used to record information about how you use our website, which is then processed by Facebook. This makes it possible to display interest-based ads (“Facebook Ads”) to users of the website, and users of Facebook who belong to a comparable target group, when they visit the Facebook social network. Your browser uses Facebook pixels (small graphics that are also embedded on our website, are automatically loaded when you visit our website, and enable tracking of user behavior) to automatically establish a direct connection with the Facebook server. Embedding Facebook pixels allows Facebook to process the information generated by cookies about the use of our website by your device – e.g. the fact that you have visited a certain page – and process, among other things, the data mentioned under “Using our website”, in particular your IP address, browser information, the website visited before, the Facebook ID and the date and time of the server request, for the purpose of serving personalized ads. For this purpose, it is also possible to determine whether different devices belong to you or to your household. If you are registered with a Facebook service, Facebook can associate the information recorded with your account. Even if you are not registered with Facebook or have not logged in, it is possible that the provider will obtain and process your IP address and other identifying information. The legal basis for the processing of your data is your consent pursuant to Art. 6(1) Sentence 1(a) GDPR. Facebook also processes the data in part in the US. The EU Commission has not issued an adequacy decision for data transfers to the US; the legal basis for transfers to the US is your consent under Art. 49(1) Sentence 1(a) GDPR. The information in Facebook cookies will be stored for a maximum of three months. For further information about the protection of your data and how long Facebook stores your data, please refer to: https://www.facebook.com/privacy/explanation and https://www.facebook.com/policies/cookies/

Hotjar

We use Hotjar to better understand the needs of our users and to optimize the offering and experience on this website. With the help of Hotjar’s technology, we gain a better understanding of our users’ experiences (e.g. how much time users spend on which pages, which links they click, what they like and what they don’t, etc.) and this helps us align our offering with user feedback. Hotjar uses cookies and other technologies to collect data about the behavior of our users and their devices, in particular the IP address of the device (which is only collected and stored in anonymized form during your website usage), screen size, device type (unique device identifiers), information about the browser used, location (country only), and the preferred language for displaying our website. Hotjar stores this information on our behalf in a pseudonymized user profile. Hotjar is contractually prohibited from selling the data collected on our behalf.
For more information, please refer to the ‘about Hotjar’ section on Hotjar’s help page.

LinkedIn Ads

The website also uses the “LinkedIn Marketing Solutions” feature, which is provided by LinkedIn Ireland Unlimited Company (Wilton Place, Dublin 2, Ireland; LinkedIn Corp, 1000 West Maude Avenue Sunnyvale, CA 94085 US; hereinafter referred to as: LinkedIn). Tracking technologies such as cookies, tracking pixels and device fingerprinting are used to collect information about how you use our website, which is processed by LinkedIn. This makes it possible to display interest-based ads to users of the website, and users of LinkedIn who belong to a comparable target group, when they visit the LinkedIn website. Your browser uses LinkedIn pixels (small graphics that are also embedded on our website, are automatically loaded when you visit our website, and enable tracking of user behavior) to automatically establish a direct connection with the LinkedIn server. Embedding the pixels allows LinkedIn to process the information generated by cookies about the use of our website and forms (such as making contact, free information services, CV check, registering for an event) by your device – e.g. the fact that you have visited a certain page – and process, among other things, the data mentioned under “Using our website”, in particular your IP address, browser information, the website visited before and the date and time of the server request, for the purpose of serving personalized ads. For this purpose, it is also possible to determine whether different devices belong to you or to your household. If you are registered with LinkedIn, LinkedIn can associate the information recorded with your account. Even if you are not registered with LinkedIn or have not logged in, it is possible that the provider will obtain and process your IP address and other identifying information. The legal basis for the processing of your data is your consent pursuant to Art. 6(1) Sentence 1(a) GDPR. LinkedIn also processes the data in part in the US. The EU Commission has not issued an adequacy decision for data transfers to the US; the legal basis for transfers to the US is your consent under Art. 49(1) Sentence 1(a) GDPR. For further information about the protection of your data and how long LinkedIn stores your data, please refer to: https://www.linkedin.com/legal/privacy-policy?trk=content_footer-privacy-policy

LinkedIn Conversion Tracking

We use the services of “LinkedIn Marketing Solutions”, provided by LinkedIn Ireland Unlimited Company (Wilton Place, Dublin 2, Ireland; LinkedIn Corp, 1000 West Maude Avenue Sunnyvale, CA 94085 US; hereinafter referred to as: LinkedIn) to draw attention to our services with the help of ads on the LinkedIn website. In relation to the data of the advertising campaigns, we can determine how successful the individual advertising activities are. If you reach our website via a LinkedIn ad, LinkedIn stores a cookie on your device. LinkedIn uses the cookies to process the information generated by your device about interactions with our ads (retrieval of a particular web page or click on an ad) and forms (such as making contact, free information services, CV check, registering for an event), and the data mentioned under “Using our website” – in particular your IP address, browser information, the website visited before and the date and time of the server request – for the purpose of analyzing and visualizing the reach of our ads. For this purpose, it is also possible to determine whether different devices belong to you or to your household. Due to the marketing tools used, your browser automatically establishes a direct connection to the LinkedIn server. If you are registered with LinkedIn, LinkedIn can associate the visit with your account. Even if you are not registered with LinkedIn or have not logged in, it is possible that the provider will obtain and process your IP address. LinkedIn only provides us with statistical analyses for the purpose of measuring the success of our ads. The legal basis for this processing is your consent under Art. 6(1) Sentence 1(a) GDPR. LinkedIn also processes the data in part in the US. The EU Commission has not issued an adequacy decision for data transfers to the US; the legal basis for transfers to the US is your consent under Art. 49(1) Sentence 1(a) GDPR. For further information about the protection of your data and how long LinkedIn stores your data, please refer to: https://www.linkedin.com/legal/privacy-policy?trk=content_footer-privacy-policy

Signals and Google Ads Personalization

We use Google Signals and Google Ads Personalization in our efforts to improve the relevance of the ads we show you and provide you with a personalized user experience. Google Signals enhances our analytics capabilities by allowing us to create cross-device and cross-user interaction reports, giving us insights into the cross-device usage of our website. By enabling Google Ads Personalization, we can also ensure that the advertising you see on our website and on the Google advertising network is better tailored to your interests. Both features use information from your Google Account (if you are logged in and have allowed personalization), including your web and app browsing history that Google has collected through its services, to personalize the advertising experience. We would like to point out that personal data may be processed when you use these features. Your data protection rights, including the option to withdraw your consent to data processing at any time, remain unaffected by this. For more detailed information on the features mentioned and your data protection rights, please refer to the further sections of this privacy policy.

stape.io

In order to offer you an optimized user experience and to make our marketing strategies effective, we use stape.io for server-side tracking on our website. This enables us to control data processing operations on the server side and thus increase data security. In addition, we use the conversion APIs of Google Ads and Meta (Facebook) to better understand and improve the effectiveness of our advertising campaigns on these platforms. These tools help us to carry out advertising campaigns in a targeted and data protection-friendly manner. We would like to point out that personal data, such as your IP address or website activities, may be processed in this context, which is carried out strictly in accordance with the provisions of the General Data Protection Regulation (GDPR) and in compliance with the highest data protection standards. Your data will only be processed with your express consent and you have the right to withdraw this consent at any time. For more detailed information on the individual data processing activities and your rights in this regard, please refer to the further sections of this privacy policy.

TikTok

Our website uses the TikTok Pixel, an analysis tool from TikTok Technology Limited, to analyze user behavior on our website and to optimize our online marketing measures. This processing only takes place with your express consent in accordance with Art. 6 para. 1 lit. a GDPR, which you can give via our cookie banner (it is best to insert a link to the tool here). The TikTok Pixel helps us to understand how visitors interact with our website by collecting data about your use of our website. This information is used to evaluate and improve the effectiveness of our advertising on TikTok.

Last update: April 05, 2024