The following information is for employees of the Bertelsmann Group who apply for or take part in a Udacity Nanodegree within the Bertelsmann Scholarship 2027 (the "Program"). It explains how Bertelsmann and – for certain parts of the processing – Udacity process personal data, and serves to comply with Art. 13 and 14 GDPR. It is provided for your information; it does not require your consent.

1. Who is responsible for the use of your data?

Bertelsmann SE & Co. KGaA, Department Bertelsmann University, Carl-Bertelsmann-Straße 270, 33311 Gütersloh, Germany, e-mail: university@bertelsmann.com ("Bertelsmann") is responsible for the processing described in Sections 2.1 to 2.5.

For the Enterprise services covered by the data processing agreement, Accenture GmbH, Campus Kronberg 1, 61476 Kronberg, Germany, processes personal data on behalf of Bertelsmann. These services include account administration, enrollment, learner support and Enterprise reporting through the Udacity Management Platform. Udacity privacy information: www.udacity.com/legal/privacy.

You can contact Bertelsmann's Data Protection Officer at the address above ("For the attention of the Data Protection Officer") or at datenschutz@bertelsmann.de.

2. Which data are used for which purpose?

2.1 Application and selection

What we process: first name, last name, business e-mail address, job title, Levio employee ID, country, division, the Nanodegree you apply for, your motivation and your confirmations in the application form. The form is provided by our service provider Lamapoll (Lamano GmbH & Co. KG, Berlin) on our behalf.

Purpose and legal basis: to process your application, select participants and allocate the Nanodegree seats (Art. 6(1)(b) GDPR – steps prior to and performance of the participation agreement; for employees of German group companies also § 26(1) BDSG). Selection is made by Bertelsmann University staff; no automated decision-making and no AI is used for the selection. Your motivation text is used for the selection only; it is not shared with your manager or HR.

Retention: application data of participants are kept for the duration of the Program and deleted twelve months after its end; division and job title are evaluated until then only in aggregated form for planning future cohorts (Section 2.5); data of applicants who do not receive a seat are deleted six months after the selection has been completed, unless you have been placed on the waiting list (Section 2.4) or statutory retention periods apply.

2.2 Enrollment with Udacity

What we process: your name and business e-mail address, which we transmit to Udacity on a participant list so that your seat in the selected Nanodegree can be activated.

Purpose and legal basis: to provide the Program to you (Art. 6(1)(b) GDPR; § 26(1) BDSG). You create or use your Udacity account yourself and accept Udacity's terms of use and privacy notice when you register. Everything you do on the platform – learning activity, projects, project reviews, mentor contacts – is processed by Udacity under its own responsibility.

2.3 Learning history in Levio and information to your employer

What we process: your participation status in the Program (applied, selected, waiting list, started, ended), the Nanodegree in which you are enrolled, your progress status (e.g. progress in per cent, as reported by Udacity) and your completion. Bertelsmann receives progress and completion information from Udacity via Udacity's enterprise reporting.

Purpose and legal basis: these data are recorded in your learning plan and learning history in Levio, the learning system of the Bertelsmann Group, and are thereby available to the HR department of the Bertelsmann Group company that employs you, as documentation of your professional development (legitimate interest of Bertelsmann and of your employer in documenting training within the Group and in administering the seats provided, Art. 6(1)(f) GDPR; for your employer also § 26(1) BDSG). Your learning history is visible to you, your manager, your responsible HR department and Bertelsmann University. On this basis your HR department may contact you about the Program, for example to offer support. These data are not used to assess your work performance and not for objectives or personnel decisions. Your employer processes them under its own responsibility as part of your personnel and training records; Bertelsmann and your employer are separate controllers in this respect.

What is not transferred: your motivation text, your learning time, your answers in questionnaires and your project work and its reviews on the Udacity platform. Bertelsmann University uses your completion data for the evaluation only automatically and in aggregated form (Section 2.5).

Right to object: you may object to this transfer at any time for reasons arising from your particular situation (Art. 21 GDPR) by e-mail to university@bertelsmann.com.

Retention: entries in Levio are kept until you leave the Bertelsmann Group, or until your objection has been accepted.

2.4 Waiting list (optional, consent)

If all seats are taken, you may be placed on a waiting list. If you tick the corresponding optional box, Bertelsmann University shares your name, business e-mail and Levio ID with your HR department so that HR can contact you about alternatives (Art. 6(1)(a) GDPR). You may withdraw your consent at any time with effect for the future by e-mail to university@bertelsmann.com. Waiting-list data are deleted when the waiting list is closed, at the latest twelve months after the program ends.

2.5 Evaluation of the Program

What is evaluated: the number of applicants and participants, completion rates, which Nanodegrees are chosen and completed and which job titles take part. The evaluation runs automatically and produces aggregated results only.

How we evaluate: your application data (division and job title) are linked automatically via your Levio ID with your completion as reported by Udacity. Only totals and averages for groups are produced.

What is reported: reports contain only totals and averages for groups of at least five persons per division and, as soon as results are broken down by job role (grouped job titles), of at least ten persons – also where several characteristics are combined; results are never broken down further than by division and job role. They go to the divisional learning and development teams, to the Bertelsmann University program team and to Group committees such as the Executive Board. Individual results – such as your progress or your learning time – are not given to your employer, your manager or HR; they are not used to assess your work performance.

Legal basis: legitimate interest in evaluating, steering and planning our learning programs (Art. 6(1)(f) GDPR). You may object to it for reasons arising from your particular situation (Art. 21 GDPR) by e-mail to university@bertelsmann.com; your data will then not be included in the evaluation.

Udacity is not responsible for Bertelsmann's reporting.

3. Who receives your data?

Within Bertelsmann, only Bertelsmann University staff who need your data for the purposes in Section 2 have access. They receive the results of the evaluation under Section 2.5 in aggregated form only. The following service providers process data on our behalf as processors under data processing agreements (Art. 28 GDPR):

• Lamano GmbH & Co. KG (Lamapoll), Berlin – application forms; hosted in data centres in Germany;
• SAP (SuccessFactors) – technical basis of the group learning system Levio.

Your employer's HR department receives the data described in Section 2.3 (and, with your consent, 2.4). Udacity receives your enrollment data (Section 2.2) and processes your platform activity as a separate controller.

4. Is your data transferred outside the EU/EEA?

Udacity is located in the USA. Your enrollment data (name, business e-mail) are transferred to Udacity on the basis of the EU-U.S. Data Privacy Framework certification of Udacity, Inc. / EU Standard Contractual Clauses. For data you provide directly on the Udacity platform, Udacity's privacy notice applies. You can request a copy of the safeguards via the contact details in Section 1.

5. What are your rights?

You have the rights under Chapter III GDPR towards each controller: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection to processing based on legitimate interests (Art. 21, see 2.3 and 2.5) and withdrawal of consent (Art. 7(3), see 2.4). You may also lodge a complaint with a supervisory authority; for Bertelsmann SE & Co. KGaA this is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (Kavalleriestr. 2–4, 40213 Düsseldorf, poststelle@ldi.nrw.de). You can also contact the supervisory authority at your place of residence or work. To exercise your rights towards Bertelsmann, write to university@bertelsmann.com or datenschutz@bertelsmann.de; towards Udacity, see Udacity's privacy notice. Submitted application forms cannot be edited by you; to correct information, contact university@bertelsmann.com.

6. Where do your data come from?

Bertelsmann collects the data in Sections 2.1, 2.2, 2.4 directly from you. Your progress status and completion (Section 2.3) are received from Udacity.

7. Is there any automated decision-making?

No. Bertelsmann does not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR for the purposes in Section 2.

8. Version

Version 2027-1, 30.09.2026. We update this notice when the Program or the processing changes.