Sooniversity Privacy Policy

Sooniversity is a mobile app and platform operated by Study.eu GmbH (“Study.eu”). Study.eu takes your privacy seriously. With this Policy, we intend to inform the public why and how we collect, store and process personal data, and inform data subjects about their rights in relation to their personal data. We will only collect, store, and use personal data in the ways described in this document, and in strict abidance by the applicable laws and regulations.

As a company based in Germany, Study.eu complies with the General Data Protection Regulation (EU) 2016/679 (“GDPR”, or “DSGVO” in German), the Bundesdatenschutzgesetz (Federal Data Protection Law, “BDSG”) and the Telemediengesetz, (Tele Media Law, “TMG”).

We kindly ask you to carefully read this document. Some of our services require your explicit consent to this Privacy Policy. Please take particular notice of the sections “Purposes of our data processing” and “How personal data is shared”. If you have any questions, comments, or objections, please contact us immediately at privacy a study.eu.

This Privacy Policy comes into effect on 1 August 2024.

1. Definitions

2. Who we are

This is the Privacy Policy for the Sooniversity app and platform. Sooniversity is operated by Study.eu GmbH, Geibelstr. 54, 22303 Hamburg, Germany. We can be reached via e-mail at privacy a study.eu.

Please note that in some instances when we collect, store and process personal data, our role is that of the data controller (Art. 4(7) GDPR), whereas in some other instances our role is that of the data processor (Art. 4(8) GDPR) on behalf of third-parties - in most cases educational institutions - for whom we collect, store and process data, in which case the respective third-party is legally the data controller.

3. Supervisory authority

As a company based in Hamburg, Germany, the supervisory authority responsible for us is the

Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI)
Telephone: +49-40-42854-4040
E-mail: mailbox@datenschutz.hamburg.de

4. How personal data is collected

We collect personal data in a number of ways:

• When you visit and use our Website
• When you submit your data through a contact form on the Website
• When a third-party creates a Sooniversity account on your behalf or submits personal data about you to us in any other way
• When you download and install the app on your mobile device or visit the platform with your web browser
• When you use Sooniversity
• When you contact us, or make public posts or comments, through our social media channels
• When you send an e-mail to us or contact us by other means
• When you open e-mails sent by us or click on hyperlinks in them
• When you submit your personal data to us in any other way

5. Types of personal data processed by us

We collect, store and process the following types of personal data:

• Website usage data, such as:
  • Referring website (if any)
  • Pages opened
  • Time spent on the website
  • Links clicked
• Personal data:
  
  • Name
  • Date of birth
  • Gender
  • Nationality
  • E-mail address
  • Telephone number
  • Postal address
  • Educational details, such as the programme you are enrolled in
  • IP address and corresponding geolocation
  • Type and version of devices and/or software with which you interact with Sooniversity
  • Behaviour when using Sooniversity
• Other data:
• Communication with us via e-mail or other communication channels
• Other information you choose to share with us

Where we deem it necessary or beneficial to best fulfill the purposes of our data processing (see section “Purposes of our data processing”), and in particular in order to be able to recommend suitable study and career options to you, we may complement the data we store about you with information from publicly available sources, such as your public social media profiles.

6. Purposes of our data processing

We collect, store and process personal information for the following purposes:

• Provide the Sooniversity app and platform on behalf of third-parties: Sooniversity is a community app and platform which we provide to third-parties, mainly higher education institutions, to allow them to connect their students. In order to do so, in certain instances, this makes the respective third-party the data controller. (Legal basis: necessity as per Art. 6(1b) GDPR, legitimate interest as per Art. 6(1f) GDPR.)
• Transmit your specific requests to universities: When you inquire information about study options, we may transmit your data to university recruiters so that they are able to provide you with relevant information. (Legal basis: necessity as per Art. 6(1b) GDPR.)
• Improve the performance and value of our Website and publications for you and other users: Tracking and analysing user behaviour on our channels is vital for the ongoing improvement of our products and services. Our continuous development work relies on identifying what works (or does not work) well for our users. (Legal basis: legitimate interest as per Art. 6(1f) GDPR.)
• Initiate and evaluate performance of business relationships: We process personal data for the purpose of entering into business agreements with third-parties and evaluating the performance of activities and services rendered as part of such agreements. (Legal basis: legitimate interest as per Art. 6(1f) GDPR.)
• Protect ourselves, our partners and our users from malicious third-parties: Website usage data is also collected, processed and analysed in order to protect our Website - and thus our users and their data - from malicious third-parties. (Legal basis: legal compliance as per Art. 6(1c) GDPR, public interest as per Art. 6(1e) GDPR, legitimate interest as per Art. 6(1f) GDPR.)

7. How data is stored

Protecting your personal data against loss or unlawful use is of the highest importance to us. We ensure that our systems and processes follow industry best practices.

Some or all of your data may be stored outside of the European Union, in some cases on servers and in storage solutions provided by third-parties. We exercise care and diligence in choosing our partners to ensure the highest standards for safety and security. All third-parties with whom we work for data storage are based in the EU, based in the US and certified under the EU-US Data Privacy Framework, or can otherwise reliably ensure compliance with the GDPR and BDSG. Your personal data will be stored for as long as necessary for the purposes as described in this Policy, or as long as necessary for us to comply with our legal or contractual obligations, and will be deleted thereafter.

Within our organisation, access to personal data follows strict access protocols. Controls are in place to ensure that personal data is only accessible to those that need access for the purposes as described in this Policy.

Cookies

Like many other websites, this website uses cookies. Cookies are files that are locally stored by your internet browser on your computer. Cookies allow us to add user-friendly services to our website that would not be possible without placing cookies. Such cookies may contain personal information and may be used to identify data subjects. Our website users can, at any time, prevent cookies from being set by making the respective setting in their web browser. Furthermore, they can delete previously set cookies in such a manner. If cookies are disabled or deleted, it will very likely adversely affect usage of our website, and potentially render some or all of our services unusable.

8. How personal data is shared

In order to achieve the purposes of our data processing (see Purposes of our data processing), and/or in order to comply with legal, regulatory or contractual requirements, we may share your personal data with third-parties. Data is shared in line with the legal bases indicated in the section “Purposes of our data processing”. Third-parties with whom we share data fall into one of the following categories:

Technology service providers

To achieve the purposes of our data processing, we cooperate with third-parties that render technological services to us. These include analytics providers, server operations providers, data storage providers, mail processing providers, security solutions providers, advertising delivery networks, and content delivery providers e.g. for fonts, images or videos.

Education providers

When you use the Sooniversity app and platform, some of your behaviour and submitted information as well as certain analytical information may be visible to or will be shared with the third-party of whose community you are a member

Affiliated companies

To achieve the purposes of our data processing as described in this Policy, we may share personal data with companies affiliated to us, i.e. shareholding companies, subsidiaries, or associate companies (i.e. subsidiaries of our shareholders).

Sponsors for prize draws

If you participate in a prize draw and are among the winners, it may be necessary for us to share your contact details with the respective prize sponsor in order for them to ship the prize. Each prize draw may have more explicit Terms & Conditions that will apply. Please consult them when applicable.

Other third-party website operators

Our Website, as well as content by us on other channels, contain hyperlinks to third-party websites. When you follow such links, you will leave our Website. This Policy only applies to our Website and our services. When you leave our Website through a link, we are not responsible nor liable for the ways in which the respective third-parties collect, process or store your data. Please consult their respective privacy policies for more information.

9. Your rights

The GDPR grants you, as the data subject, certain rights in relation to your personal data. Specifically, these include:

• the right to access your data, within the scope of Art. 15 GDPR,
• the right to rectify personal data that we have about you, within the scope of Art. 16 GDPR,
• the right to erase data from our storage, within the scope of Art. 17 GDPR,
• the right to restrict the processing of our data under certain conditions, within the scope of Art. 18 GDPR,
• the right to receive your data in a machine-readable format, within the scope of Art. 20 GDPR,
• the right to object to our processing of your personal data, within the scope of Art. 21 GDPR.

If you wish to exercise any of your rights in relation to how we collect, store or process your personal data, either follow the instructions that we provide in the relevant channel or material, or send an e-mail to us at privacy a study.eu. Note that these rights are not absolute. In some cases, considering all factors, We may have the right to decline requests fully or partially. Furthermore, if you wish to revoke your consent to receive marketing communications by us at any given time, please follow the instructions provided in the relevant channel or material, or inform us via e-mail to privacy a study.eu.

If you believe we act in violation of the GDPR, you have the right to make a complaint with the responsible supervisory authority. Please refer to the section “Supervisory authority” for more details.

10. Changes to this Privacy Policy

When this Privacy Policy comes into effect it replaces our previous Privacy Policy. We reserve the right to alter or otherwise make changes to this Policy. In case of significant changes, we will contact you via e-mail to inform you of what has changed.