The following information shall inform Bertelsmann applicants of the Udacity Scholarship Program about how Bertelsmann and in certain parts of the processing Udacity processes personal data. This information serves to comply with the duties imposed under the General Data Protection Regulation (GDPR).

1. Who is accountable for the use of your data? 

Bertelsmann SE & Co. KGaA
Department: Bertelsmann University
Carl-Bertelsmann-Straße 270 33311
Gütersloh Tel: +49 (0) 5241-80-0
Fax: +49 (0) 5241-80-62321
E-mail: university@@bertelsmann..com

(hereinafter „Bertelsmann“)

and

Udacity EMEA Holdings Ltd
70 Sir John Rogerson’s Quay
Dublin, Ireland D02R296

(hereinafter „Udacity“)

are jointly responsible for the following data processing. The joint responsibilities persist only for the processing operations described below, where joint responsibility is explicitly indicated. Separate responsibilities of the mentioned parties are also referred to in the following sections. To the extent that certain Processing Activities are not described in this Privacy Notice, Udacity is solely and exclusively responsible. Every processing of personal data is conducted in compliance with the GDPR as well as possibly applicable other national legislation. 

You can contact the designated Data Protection Officer of Bertelsmann at the address indicated above by using the reference ‘For the attention of the Data Protection Officer’ or by writing to: datenschutz@bertelsmann.de.

You can contact Udacity’s designated Data Protection Officer by writing to: Bird & Bird DPO Services

SRL, Avenue Louise 235 b 1, 1050 Brussels, Belgium DPO@udacity.com

2. Which data are used for which purpose? 

The Parties use your data for the following purposes: 

2.1 Submission of the application form and selection procedure

2.1.1 Description and extent of the processing 

For the application of the participants to the Bertelsmann Scholarships, that are employed by any Bertelsmann Group Company, Bertelsmann and Udacity jointly design application forms that must be completed by the potential participants. Data usually processed within the application forms are name, surname, country participant is currently living or working from, peoplenet ID, age greater than 18, English language proficiency, motivational questions and technical prerequisites questions where applicable etc. These are used to then jointly select a range of potential participants for the Bertelsmann Employee Scholarship. Bertelsmann and Udacity are jointly responsible for the data processing involved in the application and selection process. For the application and selection procedure of non-employee participants to the Bertelsmann Scholarships Udacity is solely and exclusively responsible.

2.1.2 Purposes and legal basis for the use of personal data 

The legal basis for collecting and processing your data in the application and selection process is the performance of the contract 6 (1) b GDPR. If individual data collection or processing is based on consent in the application form, consent Art. 6 (1) a GDPR is the applicable legal basis in these specific cases. Some data and information within the application form may be collected on the basis of legitimate interests Art. 6 (1) f, such as the peoplenet ID for employees.

2.1.3 Duration of storage 

Your data are usually retained no longer than necessary for the purposes for which it is processed. Usually once the Scholarship and all related circumstances to the Scholarship which require further processing of your data are over, your data will be deleted. This does not apply if legal retention periods require further storage of your data. For retention periods of Udacity please see: www.udacity.com/legal/en-eu/privacy

2.1.4 Right to object 

You may withdraw your consent at any time with future effect by notifying the company of your withdrawal via university@bertelsmann.com with the subject "Withdrawal consent". If your data is processed on the basis of a legitimate interest pursuant to Art. 6 (1) (f) GDPR, you can object to the processing of your data at any time for reasons arising from your particular situation by sending an e-mail to university@bertelsmann.com. This does not apply if the storage of your application data is necessary for completing precontractual procedures or fulfilling a contract. For exercising your rights at Udacity please visit: www.udacity.com/legal/en-eu/privacy

2.2.Upload of the scholarship participation/completion to the learning plan and learning history on peoplenet

2.2.1 Description and extent of the processing 

As part of their application for the Udacity Scholarship Program, participants have to indicate their peoplenet ID if they are employees of the Bertelsmann Group. The peoplenet ID provided, their participation in the scholarship program is added to the learning plan and learning history in the peoplenet employee profile. The learning plan/learning history is only visible to the employee, their manager, the responsible HR department and Bertelsmann University. Udacity is not responsible for the mentioned processing concerning the upload of the scholarship to the learning history and plan within peoplenet.

2.2.2 Purposes and legal basis for the use of personal data 

The data processing is required for the support and development of participants during the scholarship program. The legal basis for uploading the scholarship program is Article 6 (1) lit. f GDPR. 

2.1.3 Duration of storage 

Your data are usually retained no longer than necessary for the purposes for which it is processed. The information on the completion or non-completion of the Scholarship is deleted within the peoplenet training plan and history at the latest upon leaving the Bertelsmann Group and at the earliest upon objection to the processing or as soon as the purpose of processing has ceased.

2.2.4 Right to object 

If your data is processed on the basis of a legitimate interest pursuant to Art. 6 (1) (f) GDPR, you can object to the processing of your data at any time for reasons arising from your particular situation by sending an e-mail to university@@bertelsmann..com.

2.3 Course progress transmission 

2.3.1 Description and extent of the processing 

During the learning process for the Scholarship Program, the course progress will be evaluated by Udacity and Bertelsmann jointly, if the participants are employees of the Bertelsmann Group Companies. For the evaluation of course progress of non-employee participants in the Bertelsmann Scholarships, Udacity is solely and exclusively responsible. Participants can provide their consent for the transmission of their individual course progress if they are employees of the Bertelsmann Group to their respective HR department of the Bertelsmann Group Company. If consent is given, course progress information, including your first and last name, will be transmitted to the respective and responsible HR department during the scholarship program. This information is voluntary, and your course progress is generally only visible to you, Bertelsmann University and your respective and responsible HR department. The HR Departments might reach out for supporting purposes with the courses and Scholarship in general.

2.3.2 Purposes and legal basis for the use of personal data 

The legal basis for collecting and processing your data for the realization of the Scholarship is the performance of the contract 6 (1) b GDPR. The data processing is required for the support and development of participants during the scholarship program. The legal basis for forwarding the course progress of the scholarship program to the HR departments for contacting and supporting purposes is Article 6 (1)  a GDPR. 

2.3.3 Duration of storage 

Your data are usually retained no longer than necessary for the purposes for which it is processed. The data will be stored for the duration of the scholarship program. Regarding the retention of the completion or non-completion status within peoplenet see 2.1.3.After the end of the scholarship program, the data will be stored exclusively to give evidence that the company has obtained your consent for the processing of the data. For retention periods of Udacity please see: www.udacity.com/legal/en-eu/privacy

2.3.4 Right to object 

You may withdraw your consent at any time with future effect by notifying the company of your withdrawal via university@bertelsmann.com with the subject "Withdrawal consent". This does not apply if the storage of your application data is necessary for completing precontractual procedures or fulfilling a contract. For exercising your rights at Udacity please visit: https://www.udacity.com/legal/en-eu/privacy

2.4 Reporting

2.4.1 Description and extent of the processing 

The data collected during the application and learning process and progress is evaluated jointly by Udacity and Bertelsmann as part of reporting. The pseudonymized reports are then part of the reporting to the Bertelsmann board of directors. Udacity is not responsible for the processing within the reporting process to the board of directors. For the evaluation of course progress of non-employee participants in the Bertelsmann Scholarships Udacity is solely and exclusively responsible and will share only aggregated reporting with Bertelsmann. The pseudonymized reports are then part of the reporting to the Bertelsmann board of directors. Udacity is not responsible for the processing within the reporting process to the board of directors.

2.4.2 Purposes and legal basis for the use of personal data 

The data processing is required for the support and development of participants during the scholarship program and for further planning and improvement of upcoming Scholarships. The legal basis for uploading the scholarship program is Article 6 (1) lit. f GDPR. 

2.4.3 Duration of storage 

Your data are usually retained no longer than necessary for the purposes for which it is processed. The reports are pseudonymized and are therefore kept until an evaluation of the previous results and circumstances in connection with the scholarships no longer represent a value for future planned Scholarships. Regarding the duration of storage and deletion to the data processed within the Scholarship programs, which build the basis of the reports, please see 2.1.3, 2.2.3., 2.3.3. 

2.4.4 Right to object 

If your data is processed on the basis of a legitimate interest pursuant to Art. 6 (1) (f) GDPR, you can object to the processing of your data at any time for reasons arising from your particular situation by sending an e-mail to university@@bertelsmann..com. For exercising your rights at Udacity please visit: https://www.udacity.com/legal/en-eu/privacy

3. Who obtains your data? 

Within Bertelsmann only those departments will have access to your data who need them in order to fulfil the purposes outlined in section 2. Service providers used by the company may also receive access to your data (so-called "order processors", e.g. data centers, web tracking). Via Data Protection Agreements, the binding of instructions, the data security and the confidential handling of your data by these service providers are ensured. 

For more information on the transfer of your data to other recipients by Udacity, please visit: https://www.udacity.com/legal/en-eu/privacy

4. Is your data transferred outside of the EU (Third country transfer)? 

Service providers used for the technical provision of IT systems for the communication of the recipients named in Section 3 and for the transfer of data may be located outside the European Union or the European Economic Area ("EU" or "EEA"). By concluding standard contractual clauses or within the scope of an applicable adequacy decision, it is ensured that the European level of data protection is guaranteed with service providers used for the third country transfer. You can request a copy of this guarantee from us using the contact details provided in section 1. 

As Udacity is based in the US, data transfer outside of the EU is taking place. For this circumstance we have concluded standard contractual clauses with Udacity. For more information on the transfer of data outside of the EU performed by Udacity please visit: https://www.udacity.com/legal/en-eu/privacy

5. What are your rights? 

You have all rights under Chapter III of the GDPR. They can be exercised towards every Controller handling your data. These rights are: 

• Right to access: You can request information about all data stored about you and how they are processed by the accountable Controller. 
• Rectification: You can request rectification, where data concerning you are wrong or outdated. 

• Erasure and to be forgotten: You can request that the Controller deletes your data. Where a deletion is conducted, the Controller shall inform any recipient about that to whom the data have been disclosed (Right to be forgotten). 
• Restriction: You can request a restriction of the data for the reasons set out by GDPR. 
• Data Portability: Where the conditions of the law are met, you can request to receive a copy of your data in a structured, machine readable and commonly used format. 
• Object: You can object the processing of your data for reasons that relate to your particular situation, if the processing is based on Art. 6 sec. 1 lit. f – legitimate interests – GDPR. 

If you have given us your consent for the processing of your data, you can withdraw this consent with effect for the future, at any time. Please address your withdrawal to the attention of our Data Protection Officer indicated in Sec. 1 above. 

Your rights also apply to the above indicated cookies. 

You also have the option of contacting a data protection authority and lodging a complaint there.

The authority responsible for Bertelsmann is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen Kavalleriestr. 2-4 40213 Düsseldorf Telefon: 0211/38424-0 Fax: 0211/38424-10 E-mail: poststelle@ldi.nrw.de 

You can also contact the data protection authority responsible for your place of residence. 

The responsible data protection authority for Udacity can be found here: https://www.udacity.com/legal/en-eu/privacy.

6. From where is your data collected? 

All data processed by us for the purposes indicated above (see section 2) are directly collected from you. We hereby provide you with the mandatory information pursuant to Art. 13 GDPR.

7. Is there any automated decision-making (including profiling)? 

For the purposes indicated in Section 2 above, we do not use automated decision making (including profiling). 

8. Final information / Version 

This document is subject of constant improvement and change. This may affect the given information about any processing of personal data.