Data Protection Harvard Online

Data Protection Notice for Bertelsmann employees that participate in the Harvard Business School Scholarship Program 

The following information shall inform Bertelsmann applicants of the Harvard Business School (HBS) Scholarship Program about how Bertelsmann and in certain parts of the processing HBS processes personal data. This information serves to comply with the duties imposed under the General Data Protection Regulation (GDPR).

1. Who is accountable for the use of your data? 

Bertelsmann SE & Co. KGaA

Department: Bertelsmann University

Carl-Bertelsmann-Straße 270 33311

Gütersloh Tel: +49 (0) 5241-80-0

Fax: +49 (0) 5241-80-62321

E-mail: university@@bertelsmann..com

(hereinafter „Bertelsmann“)

is responsible for the following data processing. However some parts of the data processing described below are in the responsibility of

Harvard Business School

Boston

MA 02163

USA

hbsonlineprivacy@hbs.edu

(hereinafter “HBS”)

The Parties mentioned above act as separate Data Controllers under applicable data protection law. The separate responsibilities of the mentioned parties are referred to in the following sections. To the extent that certain Processing Activities are not described in this Privacy Notice, HBS is solely and exclusively responsible. You can find more information about the data processing of HBS under following link: https://online.hbs.edu/legal/. Every processing of personal data is conducted in compliance with the GDPR as well as possibly applicable other national legislation. 

You can contact the designated Data Protection Officer of Bertelsmann at the address indicated above by using the reference ‘For the attention of the Data Protection Officer’ or by writing to: datenschutz@bertelsmann.de.

You can contact HBS’s designated Data Protection Officer at the address indicated above or by writing to: hbsonlineprivacy@hbs.edu.

2. Which data are used for which purpose? 

The Parties use your data for the following purposes: 

2.1 Submission of the application form and selection procedure

2.1.1 Description and extent of the processing 

For the application of the participants to the Bertelsmann Scholarships, that are employed by any Bertelsmann Group Company, Bertelsmann designs application forms that must be completed by the potential participants. Data usually processed within the application forms are name, surname, country participant is currently living or working from, peoplenet ID, age greater than 18, existence of English language proficiency, motivational questions etc. These are used to then select a range of potential participants for the Bertelsmann Projects and Scholarships. Bertelsmann is solely responsible for the data processing involved in the application and selection process of Bertelsmann employees.

2.1.2 Purposes and legal basis for the use of personal data 

The legal basis for collecting and processing your data in the application and selection process is the performance of the contract 6 (1) b GDPR. If individual data collection or processing is based on consent in the application form, consent Art. 6 (1) a GDPR is the applicable legal basis in these specific cases. Some data and information within the application form may be collected on the basis of legitimate interests Art. 6 (1) f, such as the peoplenet ID for employees.

2.1.3 Duration of storage 

Your data are usually retained no longer than necessary for the purposes for which it is processed. Usually once the Scholarship and all related circumstances to the Scholarship which require further processing of your data are over, your data will be deleted. This does not apply if legal retention periods require further storage of your data.

2.1.4 Right to object 

You may withdraw your consent at any time with future effect by notifying the company of your withdrawal via university@bertelsmann.com with the subject "Withdrawal consent". If your data is processed on the basis of a legitimate interest pursuant to Art. 6 (1) (f) GDPR, you can object to the processing of your data at any time for reasons arising from your particular situation by sending an e-mail to university@bertelsmann.com. This does not apply if the storage of your application data is necessary for completing precontractual procedures or fulfilling a contract.

2.2.Upload of the scholarship participation/completion to the learning plan and learning history 

2.2.1 Description and extent of the processing 

As part of their application for the HBS Scholarship Program, participants have to indicate their peoplenet ID if they are employees of the Bertelsmann Group. The peoplenet ID provided, their participation in the scholarship program is added to the learning plan and learning history in the peoplenet employee profile. The learning plan/learning history is only visible to the employee, their manager, the responsible HR department and Bertelsmann University. Bertelsmann is solely responsible for the mentioned processing concerning the upload of the scholarship to the learning history and plan within peoplenet.

2.2.2 Purposes and legal basis for the use of personal data 

The data processing is required for the support and development of participants during the scholarship program. The legal basis for uploading the scholarship program is Article 6 (1) lit. f DSGVO. 

2.1.3 Duration of storage 

Your data are usually retained no longer than necessary for the purposes for which it is processed. The information on the completion or non-completion of the Scholarship is deleted within the peoplenet training plan and history at the latest upon leaving the Bertelsmann Group and at the earliest upon objection to the processing or as soon as the purpose of processing has ceased.

2.2.4 Right to object 

If your data is processed on the basis of a legitimate interest pursuant to Art. 6 (1) (f) GDPR, you can object to the processing of your data at any time for reasons arising from your particular situation by sending an e-mail to university@@bertelsmann..com.

2.3 Course progress transmission 

2.3.1 Description and extent of the processing 

During the learning process for the HBS Scholarship Program, the course progress will be evaluated by Bertelsmann and HBS separately. HBS and Bertelsmann are separately responsible for evaluating the course progress transmission within their own scope. Participants can furthermore provide their consent for the transmission of their course progress to their respective HR department of the Bertelsmann Group Company they are employed. If consent is given, course progress information, including your first and last name, will be transmitted to the respective and responsible HR department during the scholarship program. This information is voluntary, and your course progress is generally only visible to you, Bertelsmann University and the HR department of your respective and responsible HR department. The HR Departments might reach out for supporting purposes with the courses and Scholarship in general.

2.3.2 Purposes and legal basis for the use of personal data 

The legal basis for collecting and processing your data for the realization of the Scholarship is the performance of the contract 6 (1) b GDPR. The data processing is required for the support and development of participants during the scholarship program. The legal basis for forwarding the course progress of the scholarship program to the HR departments for contacting and supporting purposes is Article 6 (1) a GDPR. 

2.3.3 Duration of storage 

Your data are usually retained no longer than necessary for the purposes for which it is processed. The data will be stored for the duration of the scholarship program. Regarding the retention of the completion or non-completion status within peoplenet see 2.1.3. After the end of the scholarship program, the data will be stored exclusively to give evidence that the company has obtained your consent for the processing of the data. For retention periods of HBS please see: https://online.hbs.edu/legal/.

2.3.4 Right to object 

You may withdraw your consent at any time with future effect by notifying the company of your withdrawal via university@bertelsmann.com with the subject "Withdrawal consent". This does not apply if the storage of your application data is necessary for completing precontractual procedures or fulfilling a contract. For exercising your rights at HBS please visit: https://online.hbs.edu/legal/.

2.3 Reporting

2.3.1 Description and extent of the processing 

The data collected during the application and learning process and progress is evaluated seperately by HBS and Bertelsmann as part of reporting. The aggregated data of this reporting will then be part of the reporting to the board of directors. HBS is not responsible for the processing within the reporting process to the board of directors.

2.3.2 Purposes and legal basis for the use of personal data 

The data processing is required for the support and development of participants during the scholarship program and for further planning and improvement of upcoming Scholarships. The legal basis for reporting the scholarship program is Article 6 (1) lit. f DSGVO. 

2.3.3 Duration of storage 

Your data are usually retained no longer than necessary for the purposes for which it is processed. The reports are pseudonymized and are therefore kept until an evaluation of the previous results and circumstances in connection with the scholarships no longer represent a value for future planned Scholarships. Regarding the duration of storage and deletion to the data processed within the Scholarship programs, which build the basis of the reports, please see 2.1.3, 2.2.3., 2.3.3.

2.3.4 Right to object 

3. Who obtains your data? 

Within Bertelsmann only those departments will have access to your data who need them in order to fulfil the purposes outlined in section 2. Service providers used by the company may also receive access to your data (so-called "order processors", e.g. data centers, web tracking). Via Data Protection Agreements, the binding of instructions, the data security and the confidential handling of your data by these service providers are ensured. 

For more information on the transfer of your data to other recipients by HBS, please visit: https://online.hbs.edu/legal/.

4. Is your data transferred outside of the EU (Third country transfer)? 

Service providers used for the technical provision of IT systems for the communication of the recipients named in Section 3 and for the transfer of data may be located outside the European Union or the European Economic Area ("EU" or "EEA"). By concluding standard contractual clauses or within the scope of an applicable adequacy decision, it is ensured that the European level of data protection is guaranteed with service providers used for the third country transfer. You can request a copy of this guarantee from us using the contact details provided in section 1. 

For more information on the transfer of data outside of the EU performed by HBS please visit: https://online.hbs.edu/legal/.

5. What are your rights? 

You have all rights under Chapter III of the GDPR. They can be exercised towards every Controller handling your data. These rights are: 

• Right to access: You can request information about all data stored about you and how they are processed by the accountable Controller. 
• Rectification: You can request rectification, where data concerning you are wrong or outdated. 
• Erasure and to be forgotten: You can request that the Controller deletes your data. Where a deletion is conducted, the Controller shall inform any recipient about that to whom the data have been disclosed (Right to be forgotten). 
• Restriction: You can request a restriction of the data for the reasons set out by GDPR. 
• Data Portability: Where the conditions of the law are met, you can request to receive a copy of your data in a structured, machine readable and commonly used format.

• Object: You can object the processing of your data for reasons that relate to your particular situation, if the processing is based on Art. 6 sec. 1 lit. f – legitimate interests – GDPR.

If you have given us your consent for the processing of your data, you can withdraw this consent with effect for the future, at any time. Please address your withdrawal to the attention of our Data Protection Officer indicated in Sec. 1 above. 

Your rights also apply to the above indicated cookies. 

You also have the option of contacting a data protection authority and lodging a complaint there.

The authority responsible for Bertelsmann is the 

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen Kavalleriestr. 2-4 40213 Düsseldorf Telefon: 0211/38424-0 Fax: 0211/38424-10 E-mail: poststelle@ldi.nrw.de 

You can also contact the data protection authority responsible for your place of residence. 

The responsible data protection authority for HBS can be found here: https://online.hbs.edu/legal/.

6. From where is your data collected? 

All data processed by us for the purposes indicated above (see section 2) are directly collected from you. We hereby provide you with the mandatory information pursuant to Art. 13 GDPR.

7. Is there any automated decision-making (including profiling)? 

For the purposes indicated in Section 2 above, we do not use automated decision making (including profiling). 

8. Final information / Version 

This document is subject of constant improvement and change. This may affect the given information about any processing of personal data. 