Privacy policy

Any enquiry about your personal data reaches the address above and is handled there directly.

This policy covers this study platform. The official website https://example.org and the association's other tools are governed by the privacy statement published there. In both cases the applicable law is the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications and Digital Services Data Protection Act (TDDDG).

The platform is hosted by [hosting provider — to be named by the institution] as a processor under Art. 28 GDPR on the basis of the contract concluded with them. The platform and its database sit on servers in [country — to be named by the institution].

On every visit the technically necessary connection data are processed: IP address, date and time of the request, the page or file requested, browser type, operating system, volume of data transferred and the server's response status — to deliver the platform, keep it stable and secure, and detect misuse and faults, on the basis of Art. 6(1)(f) GDPR. The hosting provider keeps access logs for a limited period stated in its own privacy statement, and the IP addresses in the logs available to us are anonymized. Processing continues beyond that only to investigate a specific security incident or to meet a legal obligation.

• Registration data: your name in Arabic and Latin script, email address, gender, date of birth, interface language.
• Identity documents: a copy of your secondary-school certificate and an ID card or passport — required when applying to a study programme, held in private storage and served only through an access-checked route.
• Optional details you enter yourself from your profile or at registration: country and city of birth (they print on your documents), residential address, telephone number.
• Academic record: enrollments and their status, courses, attendance, exam registrations and attempts, grades, promotion and graduation decisions, issued documents with their numbers.
• Attendance: your actual minutes of participation in a Zoom session, taken from the participant report and matched to you through your personal session registration.
• Financial data: claims and their items, discounts with their reasons, payments with method and date, issued receipts.
• Correspondence: your messages with the administration and your teachers, and the notifications sent to you.
• Acceptance of the terms: the moment you accepted and the edition in force then — the evidence of what you agreed to, nothing more.
• Technical data: sign-in attempts and the administrative audit log (who changed what, and when) — for the security of the platform and the explainability of its decisions.

• Entering into and performing the educational relationship — registration, teaching, examinations, documents, fees: Art. 6(1)(b) GDPR.
• Legal obligations — retention of financial and accounting records for the periods the law prescribes: Art. 6(1)(c) GDPR.
• Legitimate interests — platform security, prevention of misuse, the audit log, and keeping the academic record as the institution's own record: Art. 6(1)(f) GDPR.
• Your consent — camera and microphone in a session, your appearance in a recording, the optional Telegram channel, and loading the YouTube player when you click it: Art. 6(1)(a) GDPR. You may withdraw it at any time with effect for the future.

There is no automated individual decision-making and no profiling: admission, suspension, promotion and graduation are decided by people, and the name of the person deciding is recorded.

Inside the institution nobody sees more than their role requires. Teachers see the students of the courses they currently teach, the academic administration sees the teaching process, the administrative side sees administrative and financial matters, and a conversation is read only by its participants. This is enforced in the code, not by hiding buttons.

Outside it, data reach only those who need them for the purposes named above:

• [Hosting provider] — hosting (section 2).
• Zoom Communications, Inc., 55 Almaden Blvd, Suite 600, San Jose, CA 95113, USA; EU representative: Workvivo Limited, 4th Floor, City Quarter, Lapps Quay, Cork, T12 W832, Ireland — for the live sessions. What is sent is what your personal link requires (display name and email address); when you take part, device and connection data, join and leave times, audio, video and chat may be processed depending on the features you use.
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — hosting the recorded lectures on the institution's channel (section 7).
• [The institution's bank — to be named by the institution] — the institution's bank (section 8).
• Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands — only where online payment is enabled and you choose it; what reaches them is the payment, not your academic record.
• Telegram — only if you activate the notification channel yourself; all that reaches it is a note that something new awaits you on the platform.

Data may also be passed to professional advisers and competent public authorities where this is necessary or legally required.

Hosting and the database are in the country named in section 2. Google, Zoom and Telegram may process data in the United States or other countries outside the EU. Such transfers follow Art. 44 to 49 GDPR: Google LLC and Zoom Communications, Inc. rely, where applicable, on their certification under the EU-US Data Privacy Framework, and the European Commission's standard contractual clauses with supplementary safeguards may also apply.

That is precisely why no personal content leaves the platform through an external notification channel: the message says something is waiting, and the something is read here.

Teaching on this platform is live at its core; the recording is the material for revision afterwards. Teaching lectures are recorded after the participants have been informed, uploaded to the institution's YouTube channel as unlisted, and linked to their lesson inside the platform. Examination sessions are never recorded.

Your voice, image or spoken contribution may appear if you take part; the basis for that is your consent under Art. 6(1)(a) GDPR, while making the recording available for study rests on Art. 6(1)(b). You may keep your camera off, and you may ask for a particular passage to be edited.

What «unlisted» actually means: the video normally appears neither in YouTube search nor on the channel page, but anyone who has the link can open it and pass the link on. Access links are given only to enrolled, active students for the duration of the semester concerned. Recordings remain stored on YouTube after the semester ends and are not deleted on a schedule; what ends with the semester is their availability through the learning environment.

When a video is opened, Google may process the IP address, device, browser and usage data, and — for signed-in users — Google account data. That is why the player is not loaded here until you click it; see the cookie policy.

Payment is made by bank transfer, in cash at the administration, or online where the gateway is enabled. On a transfer we process the account holder, account details, amount, booking date and payment reference as far as they appear in the payment itself. The bases are performance of the contract (lit. b) and tax and accounting obligations (lit. c).

Accounting vouchers and the payment data they contain are kept for eight years as a rule, unless another legal rule or a pending procedure requires a longer period.

Linking your account to Telegram is something you start yourself, by scanning a code or opening a link, and you may mute or re-activate it at any time from your profile. Muting it touches neither the notification centre inside the platform nor the administration's archive copy — it affects the external nudge alone.

• Identity documents: permanently deleted if no programme item of your application is approved; where a document is replaced on request, the previous file is deleted immediately. Only the file name is logged.
• Accounting and payment records: eight years (section 8).
• Server logs: eight weeks at the host (section 2).
• Academic record and issued documents: kept as the institution's record — a certificate bearing a serial number must remain verifiable years later.
• Recordings: remain stored on YouTube after the semester ends (section 7).
• Inactive accounts: sign-in is blocked while the record is retained for statistics and administration.

This platform sets only cookies strictly necessary to run it, uses no analytics, tracking or advertising tools whatsoever, and hosts its fonts on our own server. Details are in the cookie policy.

• The connection is encrypted throughout (HTTPS), and passwords are stored in a form from which the password cannot be recovered.
• Personal files — identity documents, materials and issued documents — sit entirely outside the public directory and are served only after the requester's authorization is checked.
• Every consequential administrative change is written to an audit log: who did it, when, and to which record.
• Sign-in attempts are rate-limited per address and per account alike, and the password policy is stated on the page where you change it.

Absolute security of data transmission over the internet cannot, however, be guaranteed.

At any time you hold the right of access (Art. 15), rectification (Art. 16), erasure within the limits of statutory retention duties (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection on grounds relating to your particular situation to processing based on legitimate interests (Art. 21), and withdrawal of any consent you have given, with effect for the future (Art. 7).

A message to office@example.org or through the platform's correspondence is enough. You also have the right to lodge a complaint with a data protection supervisory authority; for the association's seat in Sample City that is in particular:

This policy may change as the service or the law changes. The edition in force appears with its date at the foot of this page, and you are notified inside the platform of any material change.