The following information is for employees of the Bertelsmann Group who apply for or take part in a Harvard Online course within the Bertelsmann Scholarship 2027 (currently "Agentic AI Foundations", the "Program"). It explains how Bertelsmann and – for certain parts of the processing – Harvard Online process personal data, and serves to comply with Art. 13 and 14 GDPR. It is provided for your information; it does not require your consent.

1. Who is responsible for the use of your data? 

Bertelsmann SE & Co. KGaA, Department Bertelsmann University, Carl-Bertelsmann-Straße 270, 33311 Gütersloh, Germany, e-mail: university@bertelsmann.com ("Bertelsmann") is responsible for the processing described in Sections 2.1 to 2.5.

President and Fellows of Harvard College, acting through Harvard Online, 114 Mount Auburn Street, Third Floor, Cambridge, MA 02138, USA, privacy contact: nicholas_redler@@harvard..edu ("Harvard Online") is separately responsible for the processing in the course and on its learning platform (your course account, admission to the course, your learning activity, certificates). Harvard Online's privacy information: huit.harvard.edu/lxp-policies; information for participants in the EEA: gdpr.harvard.edu/eeaprivacydisclosures.

Bertelsmann and Harvard Online act as separate controllers. Processing not described in this notice is the sole responsibility of Harvard Online.

You can contact Bertelsmann's Data Protection Officer at the address above ("For the attention of the Data Protection Officer") or at datenschutz@bertelsmann.de.

2. Which data are used for which purpose? 

2.1 Application and selection

What we process: first name, last name, business e-mail address, job title, Levio employee ID, country, division, your preferred course date(s), your motivation and your confirmations in the application form. The form is provided by our service provider Lamapoll (Lamano GmbH & Co. KG, Berlin) on our behalf.

Purpose and legal basis: to process your application, select participants and allocate them to the course dates (Art. 6(1)(b) GDPR – steps prior to and performance of the participation agreement; for employees of German group companies also § 26(1) BDSG). Selection is made by Bertelsmann University staff; no automated decision-making and no AI is used for the selection. Your motivation text is used for the selection only; it is not shared with your manager or HR.

Retention: application data of participants are kept for the duration of the Program and deleted twelve months after its end; division and job title are evaluated until then only in aggregated form for planning future cohorts (Section 2.5); data of applicants who do not receive a seat are deleted six months after the selection has been completed, unless you have been placed on the waiting list (Section 2.4) or statutory retention periods apply.

2.2 Enrollment with Harvard Online

What we process: your name and business e-mail address, which we transmit to Harvard Online on a participant list about 10 to 15 working days before the start of your course date. Harvard Online decides on the final enrollment.

Purpose and legal basis: to provide the Program to you (Art. 6(1)(b) GDPR; § 26(1) BDSG). You accept Harvard Online's terms of use, code of conduct and privacy notice when you register. Everything you do in the course – learning activity, contributions, assignments – is processed by Harvard Online under its own responsibility. Your name and contributions may be visible to the other participants of your course date.

2.3 Learning history in Levio and information to your employer

What we process: your participation status in the Program (applied, selected, waiting list, started, ended), the course and date in which you are enrolled, your progress status where Harvard Online reports it, and your completion or certificate. Bertelsmann receives enrollment summary and completion information from Harvard Online.

Purpose and legal basis: these data are recorded in your learning plan and learning history in Levio, the learning system of the Bertelsmann Group, and are thereby available to the HR department of the Bertelsmann Group company that employs you, as documentation of your professional development (legitimate interest of Bertelsmann and of your employer in documenting training within the Group and in administering the seats provided, Art. 6(1)(f) GDPR; for your employer also § 26(1) BDSG). You, your responsible HR department and Bertelsmann University can see this information in Levio; your manager sees your completed courses. On this basis your HR department may contact you about the Program, for example to offer support. These data are not used to assess your work performance and not for objectives or personnel decisions. Your employer processes them under its own responsibility as part of your personnel and training records; Bertelsmann and your employer are separate controllers in this respect.

What is not transferred: your motivation text, your learning time and your learning activity, contributions and assignments in the course. Bertelsmann University uses your completion data for the evaluation only automatically and in aggregated form (Section 2.5).

Right to object: you may object to this transfer at any time for reasons arising from your particular situation (Art. 21 GDPR) by e-mail to university@bertelsmann.com.

Retention: entries in Levio are kept until you leave the Bertelsmann Group, or until your objection has been accepted.

2.4 Waiting list (optional, consent)

If all seats are taken, you may be placed on a waiting list. If you tick the corresponding optional box, Bertelsmann University shares your name, business e-mail and Levio ID with your HR department so that HR can contact you about alternatives (Art. 6(1)(a) GDPR). You may withdraw your consent at any time with effect for the future by e-mail to university@bertelsmann.com. Waiting-list data are deleted when the waiting list is closed, at the latest twelve months after the program ends.

2.5 Evaluation of the Program

What is evaluated: the number of applicants and participants, completion rates, participation per course date and which job titles take part. The evaluation runs automatically and produces aggregated results only.

How we evaluate: your application data (division and job title) are linked automatically via your Levio ID with your completion as reported by Harvard Online. Only totals and averages for groups are produced.

What is reported: reports contain only totals and averages for groups of at least five persons per division and, as soon as results are broken down by job role (grouped job titles), of at least ten persons – also where several characteristics are combined; results are never broken down further than by division and job role. They go to the divisional learning and development teams, to the Bertelsmann University program team and to Group committees such as the Executive Board. Reports under this Section contain no individual results. They do not include your individual learning activity or actual learning time. The separate training records described in Section 2.3 remain unaffected; none of these data are used

Legal basis: legitimate interest in evaluating, steering and planning our learning programs (Art. 6(1)(f) GDPR). You may object to it for reasons arising from your particular situation (Art. 21 GDPR) by e-mail to university@bertelsmann.com; your data will then not be included in the evaluation.

Harvard Online is not responsible for Bertelsmann's reporting.

3. Who receives your data?

Within Bertelsmann, only Bertelsmann University staff who need your data for the purposes in Section 2 have access. They receive the results of the evaluation under Section 2.5 in aggregated form only. The following service providers process data on our behalf as processors under data processing agreements (Art. 28 GDPR):

• Lamano GmbH & Co. KG (Lamapoll), Berlin – application forms; hosted in data centres in Germany;
• SAP (SuccessFactors) – technical basis of the group learning system Levio.

Your employer's HR department receives the data described in Section 2.3 (and, with your consent, 2.4). Harvard Online receives your enrollment data (Section 2.2) and processes your course activity as a separate controller.

4. Is your data transferred outside the EU/EEA?

Harvard Online is located in the USA. There is no adequacy decision covering Harvard Online. Your enrollment data (name, business e-mail) are therefore transferred to Harvard Online on the basis of the EU Standard Contractual Clauses (controller to controller, Module 1). For data you provide directly in the course, Harvard Online's privacy information applies (see Section 1). You can request a copy of the safeguards via the contact details in Section 1.

5. What are your rights? 

You have the rights under Chapter III GDPR towards each controller: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection to processing based on legitimate interests (Art. 21, see 2.3 and 2.5) and withdrawal of consent (Art. 7(3), see 2.4). You may also lodge a complaint with a supervisory authority; for Bertelsmann SE & Co. KGaA this is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (Kavalleriestr. 2–4, 40213 Düsseldorf, poststelle@ldi.nrw.de). You can also contact the supervisory authority at your place of residence or work. To exercise your rights towards Bertelsmann, write to university@bertelsmann.com or datenschutz@bertelsmann.de; towards Harvard Online, use the privacy contact in Section 1. Submitted application forms cannot be edited by you; to correct information, contact university@bertelsmann.com.

6. Where do your data come from?

Bertelsmann collects the data in Sections 2.1, 2.2, 2.4 directly from you. Enrollment summary, progress and completion information (Section 2.3) are received from Harvard Online.

7. Is there any automated decision-making?

No. Bertelsmann does not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR for the purposes in Section 2.

8. Version

Version 2027-1, 30.09.2026. We update this notice when the Program or the processing changes.