Data Protection Notice and Cookies
The following information shall inform users of our website about how we process personal data. These information serve us to comply with our duties imposed under the General Data Protection Regulation (GDPR). Personal data means any information relating to you by which you can be identified, directly or indirectly.
1. Who is accountable for the use of my data?
Bertelsmann SE & Co. KGaA
Tel: +49 (0) 5241-80-0
Fax: +49 (0) 5241-80-62321
The above indicated company is accountable for the use of personal data on this website. Every processing of personal data on this website is conducted in compliance with the GDPR as well as possibly applicable other legislation.
You can contact the company by the means indicated above and by reference of your query. Where you want to contact the responsible data protection officer directly, add “Attention Data Protection Officer” to the address.
2. What data are concerned?
If you browse our websites by your PC certain information are collected simply for technical reasons of data flows (technical data). These technical data contain server log files, infor-mation about your browser (type, version and information of access status – success or fail), operating system, your internet service provider and your IP address, date and time of the access and from where you accessed the website (prior website or search engine). Save the IP address these information do not allow an identification of you. Where the IP address is used, we comply with the provisions of the GDPR.
If you use features of our website, a pseudonymized user profile will be created and, where you provide information by your use (e.g. search words, log in data, ratings, contract details, clicks, etc.), such data will be collected.
Some services require the provision of personal data. In these situations the respective ser-vice requested by you will be the leading purpose of our use of your data (Newsletter, member zone).
3. Which cookies are used?
In principle, cookies are only an online identification without personal reference. Cookies are personalized when other data is combined in addition to the information generated by the cookies. A distinction can be made between cookies, which are necessary for the provision of the website, and cookies, which are necessary for further purposes such as analysis of user behaviour or advertising.
In the following, we provide you with information about the cookies we use on our website.
- Cookies used to identify or authenticate users;
- Cookies that temporarily store certain user inputs (e.g. content of a shopping basket or an online form);
- Cookies that store certain user preferences (e.g. search or language settings);
- Cookies that store data to ensure the trouble-free playback of video or audio content.
Cookies, which are necessary for further purposes of the website, include the analysis cookies in order to record and statistically evaluate the usage behaviour of our users (e.g. clicked advertising banners, pages visited, search queries made).
4. Which data are used for which purpose?
The purposes for processing personal data can be found in technical, contractual, and obligations by law, as well as your consent.
We use the data listed above in sec. 2 for the following purposes:
- provision of our website including measures to assure a undisturbed service, prevent fraud and hacking and to ensure the security of our systems.
- to measure the geographical reach of our website, in order to streamline our technical support and the website operation.
- to answer contact inquiries;
- to send E-mail newsletters;
- for the administration of programs booked by participants; and
- for communication among each other within groups of participants
You can find further information about each used feature as well as the underlying purposes in the following sections.
4.1 Technical provision
4.1.1 Description and extent of the processing
For the provision of our website, including regular performance and security checks, server log files are stored as part of the information when our website is accessed. These log files contain the information and possibly personal data as indicated in section 2 above. Log files are used for the purposes of technical provision only and they are not merged with any other data. Part of the technical provision is a regular reviewing procedure that is designed to detect fraud, hacking and other forms of disruptive behavior.
4.1.2 Purposes and legal basis for the use of personal data
The legal basis for the use of server log files is to be found in Art. 6 sec. 1 lit. f GDPR. Our interest is the undisturbed, resilient and performant operation of our website.
4.1.3 Duration of storage
After accessing our website we store the server log files, including your IP address, for 7 days. Any analyses of these data are conducted only in case of a disruptive event involving these data.
4.1.4 Right to object
You are entitled to object the use of your personal data pursuant to Art. 21 GDPR on grounds that relate to your particular situation. If you want to exercise that right contact the Data Protection Officer via the means of contact indicated in section 1 above.
4.2 Contact form, E-mail or phone contact
4.2.1 Description and extent of the processing
On our website you are offered different means to get in contact with us (Contact form, E-mail address, tel.). If you use one of them, data affiliated with that means respectively (e.g. your E-mail address where you use the contact form or your phone number if you chose to call us) and of course your request will be recorded, so that we can provide you with a solution. The same applies for your query; if you use one of that means to address some question to us, we will store and use that request in a form that is linked to you as long as we need it to process it properly. Where this is necessary, some or all of the data collected under this clause can be transmitted to other entities, provided we need their support to answer your request. In that situation we ensure that the recipient has implemented a proper level of protection as well.
4.2.2 Purposes and legal basis for the use of personal data
The legal basis for using data in this regard is to be found in Art. 6 sec. 1 lit. f GDPR. Our shared interest is that you receive an adequate answer. Hence, for the time necessary for this endeavor, there is no overriding interest that prevails and excludes the data processing. Where your contact is directed towards the conclusion of a contract, the processing is based on Art. 6 sec. 1 lit. b GDPR instead.
4.2.3 Duration of storage
After responding to your request and the end of possibly further communication, your information provided for the purpose of the query will be erased unless your query was directed towards the conclusion of a contract or where you contacted us in order to exercise one of your data subjects rights. In that situation we will keep records as long as necessary for the performance of a contract or as long as we have to demonstrate our compliance with your request for your rights.
For contracts the storage period is usually between 6 and 10 years.
4.2.4 Right to object
You are entitled to object the use of your personal data pursuant to Art. 21 GDPR on grounds that relate to your particular situation. If you want to exercise that right contact the Data Protection Officer via the means of contact indicated in section 1 above. Where you object the use of your data, we might not be able to respond to your request anymore, unless it is necessary for the performance of a contract or you want to exercise one of your rights.
4.3 E-mail Newsletter
4.3.1 Description and extent of the processing
The website offers the possibility to subscribe to a newsletter maintained by us free of charge via E-mail. The newsletter offers further training opportunities and other offers for employees and interested members of staff. Your data from the registration form will be transmitted to the company and (with the help of service providers) processed further for sending the offers via E-mail. When registering, you will be asked for consent to the data processing described here via a double-opt-in procedure. You can access our data protection information at any time during this process via a link in the footer. Your data will not be passed on to third parties. Your E-mail address, name, first name and salutation is mandatory for receiving the newsletter.
4.3.2 Purposes and legal basis for the use of personal data
The processing of your data via the registration form is necessary for advertising the goods and/or services (training and further education programs) of the company. The legal basis is the consent pursuant to Art. 6 sec. 1 lit. a GDPR.
4.3.3 Duration of storage
The data is stored during the subscription period of the newsletter. After the cancellation, the data will only be stored to prove that the company has obtained your consent for sending the newsletter. The same applies if you have withdrawn your consent or if you unsubscribe from the newsletter. In all other respects, the data will be deleted by us or on our instruction by our service provider.
4.3.4 Right to object
You can withdraw your consent to receive newsletters at any time by notifying the company of your withdrawal via the E-mail address email@example.com with the subject "Newsletter withdrawal" or via the following link.
4.4. Google Analytics (Webtracking)
4.4.1 Description and extent of the processing
This website uses Google Analytics (GA). Provider of GA is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. GA is configured by use of the ‘_anonymizeIP’-code in a way that it deletes the last octet of your IP address, hence only creating pseudonymous user profiles, which cannot identify you as a person. These non-personal user profiles will be subject to analysis and evaluation. Google is contractually obliged not to merge these profiles with any data they might possibly hold from other instances.
Any occurring third country transfer is covered by Google’s certification under the US-EU Privacy Shield, which ensures that Google adheres to European standards of data protection.
You can find more information about the data processing by Google, including GA, in Google’s Data Protection Statement: https://policies.google.com/privacy?hl=de
4.4.2 Purposes and legal basis for the use of personal data
The legal basis for recording and evaluating pseudonymous usage profiles is Art. 6 sec. 1 lit. f GDPR. The company's legitimate interests lie in optimising the usability of the website and measuring its reach.
4.4.3 Duration of storage
The data that is collected and evaluated when using Google Analytics is usually stored until you withdraw its use. The analysis cookies are stored for a maximum of 24 months.
4.4.4 Right to object
You can prevent Google Analytics from collecting your data by clicking on the following link. An opt-out cookie is set which prevents the collection of your data on future visits to this website: Disable Google Analytics.
4.5 Member Area
4.5.1 Description and extent of the processing
Bertelsmann University uses a password-protected member area for selected programs to prepare and follow up the programs offered. Only nominated employees have access to this area. A personal registration by third parties is not possible. In this respect, the participant area is a non-public area and therefore a non-public part of the website. To create a user profile, the name, first name and E-mail address of the nominated employee is required. In addition, the position, company and a photo of the employee can be submitted voluntarily. The aforementioned personal data will be used exclusively for the administration of the programs and for communication within groups of participants for which you have registered.
4.5.2 Purposes and legal basis for the use of personal data
The legal basis for the collection of the required registration data is Art. 6 sec. 1 lit. b GDPR. However, voluntary information are based on Art. 6 sec. 1 lit. a GDPR. You can give your consent for the above-mentioned data in your profile area.
4.5.3 Duration of storage
You will retain access to the password-protected participant area for all nomination programs you attend at Bertelsmann University. In order to support networking with other participants of the program in the long term, we store your data for a period of 5 years after your first login. If you wish your data to be deleted from the Bertelsmann University website before the expiry date, please send an E-mail to firstname.lastname@example.org.
4.5.4 Right to object
Consent for the described data processing can be withdrawal in your personal profile at any time.
4.6.1 Description and extent of the processing
Our website uses plugins from YouTube, which is operated by Google. The operator of the pages is YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA.If you visit one of our pages featuring a YouTube plugin, a connection to the YouTube servers is established. Here the YouTube server will be informed about which of our pages you have visited.If you are logged in to your YouTube account, YouTube allows you to associate your browsing behavior directly with your personal YouTube profile.
Further information about handling user data, can be found in the data protection declaration of YouTube under https://www.google.de/intl/de/policies/privacy.
4.6.2 Purposes and legal basis for the use of personal data
YouTube is used to help making our website appealing. This constitutes a justified interest pursuant to Art. 6 (1) (f) GDPR.
4.6.3 Duration of storage
We do not store any data permanently as a result of the processing described.
4.6.4 Right to object
You can prevent YouTube from collecting your data by logging out of your YouTube account before visiting our pages.
4.7 Links to other websites / areas
This website contains links to websites of other website owners. By clicking on the links you reach the respective website (e.g. Facebook, Twitter). With the exception of your login data to supply the other website, no data will be transmitted from you to the website operators. The links are not plugins.
The data protection references exclusively to the web page of the Bertelsmann University Website. For the data protection references of other websites the company is not responsible. Nevertheless, it is recommended to carefully read their data protection information when visiting the linked websites.
4.8. Photos and videos at events
4.8.1 Description and scope of data processing.
Bertelsmann University hosts a number of exciting and interesting events for both employees of our Group and external parties. In order to capture the atmosphere, content and event circumstances for participants and interested parties, we take photos and videos (image, sound and video recordings) at our events. We intent and reserve the right to publish these recordings in whole or in part on our website, within the Group (e.g. BENET), individual or all social media accounts (e.g. Instagram, Facebook, Twitter) and/or in printed materials. This publication is associated with both a general availability for third parties and a retrievability of the recordings from countries outside the EU/EEA. In this respect, we would like to point out that we have no possibility to influence or prevent the data processing by these third parties.
4.8.2 Purposes and legal basis of data processing
We pursue different purposes with the production of photo, audio and/or video recordings as well as their publication. In addition to documentation for the participants, we aim to use the publication to present the various formats of Bertelsmann University to the outside world, including raising awareness and promotional use. In terms of data protection law, the collection and processing of personal data in the recordings is based on Art. 6 Para. 1 lit. a DSGVO in conjunction with. § Section 23 of the German Copyright Act (KUG), in that all participants are informed before the start of the event and before entering the venue that recordings are being made and that they can be removed.
4.8.3 Duration of storage or criteria for determination
Publication shall be unlimited in terms of subject matter, space and time for the respective publication types selected.
4.8.4 Options to object and remove images
The consent given explicitly or implicitly for the creation and publication can be revoked at any time. In this case, we will take appropriate measures in accordance with the type of publication in order to comply with the data subject's request. With regard to digital publications, for example on our website or social media accounts, this usually means deleting the image or pixelating the affected section of the image. However, we stress that the measures taken by us do not extend to the data processing activities of third parties who may have come into possession of the recordings without our knowledge
5. Who obtains my data?
Within our company, only those departments will have access to your data who need them in order to fulfil the aforementioned purposes. This applies accordingly to any involved Processors, if any, who might process data on our behalf (e.g. hosting and operations, mail delivery, etc.). All our Processors are contractually bound to our instructions which adheres to the high standard of data protection set out under the GDPR.
Outside our company, to so-called third parties (e.g. advertisement consultants, lawyers, or other business providers), your data will be transferred only if this is mandatory from the law, based on a legal basis, or where you have consented.
6. Are my data transferred outside of the EU (Third country transfer)?
Through the use of Google Analytics in accordance with Section 4.3, third party transfers take place, as the data centers of Google Inc. are located outside the European Union or the European Economic Area ("EU or EEA"). Such a third country transfer may result in your data being transferred to a country that does not guarantee the same data protection standard as the EU or the EEA. Through certification according to the EU-US Privacy Shield, however, Google Inc. ensures that the European data protection level is guaranteed for the third country transfer. You may request a copy of these warranties under the contact details referred to in paragraph 1.
7. What are my rights?
You have all rights under Chapter III of the GDPR. They can be exercised towards every Controller handling your data. These rights are:
- Right to access: You can request information about all data stored about you and how they are processed by the accountable Controller.
- Rectification: You can request rectification, where data concerning you are wrong or outdated.
- Erasure and to be forgotten: You can request that the Controller deletes your data. Where a deletion is conducted, the Controller shall inform any recipient about that to whom the data have been disclosed (Right to be forgotten).
- Restriction: You can request a restriction of the data for the reasons set out by GDPR.
- Data Portability: Where the conditions of the law are met, you can request to receive a copy of your data in a structured, machine readable and commonly used format.
- Object: You can object the processing of your data for reasons that relate to your particular situation, if the processing is based on Art. 6 sec. 1 lit. f – legitimate interests – GDPR.
If you have given us your consent for the processing of your data, you can at any time withdraw this consent with effect for the future. Please address your withdrawal to the attention of our Data Protection Officer indicated in Sec. 1 above.
Your rights also apply to the above indicated cookies.
You also have the option of contacting a data protection authority and lodging a complaint there. The authority responsible for the company is the
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
You can also contact the data protection authority responsible for your place of residence.
8. From where are my data collected?
All data processed by us for the purposes indicated above (see section 4) are directly collected from you. We hereby provide you with the mandatory information pursuant to Art. 13 GDPR. We do not merge these data with any information we might possibly hold from other instances.
9. Is there any automated decision-making (including profiling)?
For the purposes indicated in Section 4 above, we do not use automated decision making (including profiling).
10. Final information / Version
This website is subject to constant improvement and change. This may affect the herein given information about any processing of personal data.
Date of the data protection information: June 2018