Please note: With the following notes we inform you about the purpose, type and extent of the collection, processing, use and storage of personal data of Tomorrow's Education. We process your personal data in various contexts when you use our website. According to Art. 13 and Art. 14 EU General Data Protection Regulation (GDPR) you have the right to be informed about the processing of your personal data. Therefore, please take the time to read this privacy policy carefully.
This Privacy Policy applies to the customized study program in the area of Sustainability, Entrepreneurship and Technology, jointly run with the Executive Academy of the Vienna University of Economics and Business (WU EA), hereinafter referred to as the "University Course". It provides you with an overview of how your personal data will be processed when you apply and enroll in the University Course and when you use the Tomorrows Education App or the Tomorrows Education Platform (both hereinafter collectively referred to as "Services") as part of the study program. This Privacy Policy also informs you of your rights under the EU General Data Protection Regulation ("GDPR") and the choices you have to manage your personal data and protect your privacy.
The data controller responsible in accordance with the purposes of theGeneral Data Protection Regulation (GDPR) of the European Union and other dataprotection regulations is:
Tomorrows Education GmbHAm
Orangeriepark
513156 Berlin
Deutschland
+49 1621329265
privacy@tomorrowseducation.com
www.tomorrows.education
Registered in the Berlin-Charlottenburg Commercial Register under HRB 224106 B
The designated data protection officer is:
DataCo GmbH
Dachauer Straße 65
80335 München
Germany
+49 89 7400 45840
www.dataguard.de
I. Scope of the processing of personal data
In general, we only process the personal data of our users to the extentnecessary to provide a functioning website with our content and services. Theregular processing of personal data only takes place with the consent of theuser. Exceptions include cases where prior consent cannot be technicallyobtained and where the processing of the data is permitted by law.
II. Legal basis for the processing of personal data
Where consent is appropriate for processing personal data, Art. 6 (1) (1)(a) GDPR serves as the legal basis to obtain the consent of the data subject for the processing of their data. As for the processing of personal data required for the performance of a contract of which the data subject is party, Art. 6 (1) (1) (b) GDPR serves as the legal basis. This also applies to processing operations required to carryout pre-contractual activities. When it is necessary to process personal data in order to fulfil a legal obligation to which our company is subject, Art. 6 (1) (1) (c) GDPR serves as the legal basis. If vital interests of the data subject or another natural person require the processing of personal data, Art. 6 (1) (1) (d) GDPR serves as the legal basis. If the processing of data is necessary to safeguard the legitimate interests of our company or that of a third party, and the fundamental right sand freedoms of the data subject do not outweigh the interest of the former, Art. 6 (1) (1) (f) GDPR will serve as the legal basis for the processing of data.
III. Data removal and storage duration
The personal data of the data subject will be erased or restricted as soon as the purpose of its storage has been accomplished. Additional storage may occur if this is provided for by the European or national legislator within the EU regulations, law, or other relevant regulations to which the data controller is subject. Restriction or erasure of the data also takes place when the storage period stipulated by the aforementioned standards expires, unless the reis a need to prolong the storage of the data for the purpose of concluding or full filing the respective contract.
When your personal data is processed, you are a data subject within themeaning of the GDPR and have the following rights:
1. Right to information
You may request the data controller to confirm whether your personal data is processed by them.
If such processing occurs, you can request the following information from the data controller:
· The purpose for which the personal data is processed.
· The categories of personal data being processed.
· The recipients or categories of recipients to whom the personal data have been or will bed is closed.
· The planned duration of the storage of your personal data or, if specific information is not available, criteria for determining the duration of storage.
· The existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning you or to object to such processing.
· The existence of the right to lodge a complaint with a supervisory authority.
· Where personal data are not collected from you any available information as to their source.
· The existence of automated decision-making including profiling under Article 22 (1) and Article22 (4) GDPR and, in certain cases, meaningful information about the data processing system involved, and the scope and intended result of such processing on the data subject.
You have the right to request information on whether your personal data will be transmitted to a third country or an international organization. In this context, you can then request for the appropriate guarantees in accordance with Art. 46 GDPR in connection with the transfer.
2. Right to rectification
You have a right to rectification and/or modification of the data, if your processed personal data is incorrect or incomplete. The data controller must correct the data without delay.
3. Right to the restriction of processing
You may request the restriction of the processing of your personal data under the following conditions:
· If you challenge the accuracy of your personal data for a period that enables the data controller to verify the accuracy of your personal data.
· The processing is unlawful, and you oppose the erasure of the personal data and insteadrequest the restriction of their use instead.
· The data controller or its representative no longer need the personal data for the purpose of processing, but you need it to assert, exercise or defend legal claims; or
· If you have objected to the processing pursuant to Art. 21 (1) GDPR and it is not yet certain whether the legitimate interests of the data controller override your interests.
If the processing of personal data concerning you has been restricted, this data may – with the exception of data storage – only be used with your consent or for the purpose of asserting, exercising or defending legal claims or protecting the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
If the processing has been restricted according to the aforementioned conditions, you will be informed by the data controller before the restriction is lifted.
I. Data controllers and contact with the data protection officers
The University Course is conducted by Tomorrow University of Applied Sciences in cooperation with the Executive Academy of the Vienna University of Economics and Business. Within the framework of this cooperation, the parties jointly determine the purposes and means of the processing and are insofar deemed to be joint data controllers within the meaning of the GDPR. Below you will find the contact details of the joint controllers:
WU Vienna University of Economics and Business
Executive Academy (hereinafter WU EA)
Welthandelsplatz 1
1020 Vienna
&
ToU gGmbH (hereinafter Tomorrow)
Platz der Einheit 2
60327 Frankfurt am Main
Tomorrow's data protection officer is Intelliant GmbH, Immanuelkirchstr. 3-4, 10405 Berlin, Germany, reachable at dpo@intelliant.de or online via https://intelliant.de/contact/.
The data protection officer of WU EA can be reached at: Vienna University of Economics and Business (WU), Attn: Data Protection Officer p.A. Legal Department, Welthandelsplatz 1, Building AR, 1020 Vienna, and by e-mail at datenschutzbeauftragter@wu.ac.at.
II. Functions and relationships of the jointly responsible persons
As joint controllers, Tomorrow and WU EA have entered into an agreement to protect your data subject rights, which regulates in detail which of the controllers are subject to which data protection obligations. Within the scope of joint responsibility, WU EA is responsible for processing your personal data in connection with enrollment and your studies (including examinations), and Tomorrow is responsible for processing data in connection with your application, the use of technical services and the implementation of study operations.
If you have any questions about the processing of your data, you can contact us at any time by email at privacy@tomorrowseducation.com as the central point of contact.
Notwithstanding the foregoing, you may generally contact any of the joint data controllers with any questions you may have regarding data protection and to assert your data subject rights. When responding to your inquiries, the controllers may cooperate and exchange information about your inquiry and the stored data (e.g., we provide each other with information necessary to respond to requests for information).
III. Processing of personal data
1. Data that we process when you use our services
When you use Tomorrow’s Services, personal data is processed for technical reasons each time you access Tomorrow’s Services.
As soon as you use these services, your browser or terminal device sends technical information to Tomorrow's web servers, which is stored in server log files. The following usage and web access data is processed:
This so-called usage data is processed exclusively in pseudonymous form to enable you to use the services and to ensure the functionality of the services. The data is generally not used to identify you as a person. In addition, we process the pseudonymous usage data to analyze the performance of the website, to continuously improve the website and to correct errors or to personalize the content of the website for you. Finally, we also process the usage data to ensure IT security and the operation of our systems and to prevent or detect misuse, in particular fraud. These server log files are deleted after a maximum of 7 days. The legal basis for the processing of this data is Art. 6 (1) lit. f) GDPR, the protection and functionality of the services are legitimate interests of the responsible parties in this sense.
Cookies and other tracking tools: We use cookies to provide the technical functions for automatic processing of usage data. You can find more information here.
2. Data processing in connection with your application for the University Course
When you apply for our University Course, Tomorrow processes personal data about you that you provide, for example, via web forms. These are:
These data are required,
The data processing is carried out upon your request and is necessary according to Art. 6 (1) lit. b) and lit. f) GDPR for the stated purposes for the fulfillment of the contract and for other pre-contractual measures as well as on the basis of our legitimate interests. If you are not considered as a participant for the University Course, your data will be deleted immediately, at the latest, however, after 6 months. In all other cases, your data will be stored for as long as is necessary to achieve the stated purposes or as part of a legal storage period and then routinely deleted.
3. Data processing in connection with your admission to the University Course and enrollment
After successful completion of the application process, you can enroll for the University Course at WU EA. For this purpose, WU EA requires the following data from you:
For more information on how WU EA uses this data, as well as the purposes and legal basis, please click here.
4. Data processing in connection with the use of the eLearning platform for the implementation of the University Course.
After successful enrollment, you will receive your initial access data for the platform by email, which you can subsequently edit (e.g. by assigning an individual password).
During the course of your studies, additional personal data about you (e.g., name, matriculation number, photo, work files and results, video calls, assessments, competencies, learning history, interests, conversations, study progress) may be processed by the shared controllers through the Services provided by Tomorrow. You will also have the opportunity to evaluate learning formats during the course of your studies. Evaluations are conducted anonymously. In certain cases, you can also provide us with direct and explicitly non-anonymous feedback on the further development of the learning experience, both in terms of content and technology.
According to Art. 6 (1) lit. b) and lit. f) GDPR, the data processing is necessary for the aforementioned purposes for the fulfillment of the contract and on the basis of our legitimate interests. Your data will be stored for as long as is necessary to achieve the stated purposes or as part of a statutory storage period and then routinely deleted.
WU EA is exclusively responsible for the evaluation of your academic achievements, the administration of grades, accounting and awarding of the academic degree. You can find more information here.
IV. Recipients
Data may be disclosed to third parties if we are legally obligated to do so, or if this serves the assertion of legal claims on our part or the defense against legal disputes. In these cases, the legal basis is either a legal obligation (Art. 6 (1) lit. c) GDPR) or our legitimate interests (Art. 6 (1) lit. f GDPR).
Data recipients also include the third-party providers mentioned in our overview of cookies and analytics tools. Detailed information about the third-party providers we use in this context, e.g. for web analytics, can be found in the information about cookies, web analytics and other tracking technologies at the end of this privacy statement.
1. Integrated services (processors)
In connection with the implementation of the study as an eLearning format, Tomorrow also uses technical service providers who process personal data of you on behalf of and according to the instructions of Tomorrow. For this purpose, Tomorrow has concluded data processing agreements (DPAs) with these service providers. Through these agreements, the service providers assure that the data will be processed in accordance with the applicable data protection regulations, exclusively on documented instructions from Tomorrow, and that your data subject rights will be protected.
Your personal data will only be disclosed by Tomorrow to recipients if this is necessary for the provision of the Services. The use is made pursuant to Art. 6 (1) lit. f) GDPR due to our legitimate economic interest to provide our offer and make it interactive and pursuant to Art. 6 (1) lit. b) GDPR to provide our services. We only use processors that offer suitable guarantees in accordance with Art. 46 GDPR and conclude corresponding agreements with them.
Amazon Web Services
Tomorrow's Services are hosted on servers provided by Tomorrow's contracted service provider Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg (hereinafter "AWS"). In connection with the hosting, AWS processes personal data on Tomorrow's behalf that is collected when using the platform.
Tomorrow has chosen Frankfurt exclusively as its server location.
Tomorrow has concluded a DPA with AWS. Through this contract, the service provider assures that it processes the data in accordance with the GDPR and ensures the protection of the rights of the data subject.
For more information about AWS and data protection, please see AWS's Notice on Data Protection and the General Data Protection Regulation.
Google Workspace
For the provision of work material in connection with the studies as well as for cooperation and communication between students and between teachers and students, the platform Google Workspace, a service of Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland (hereinafter: "Google") is integrated. Tomorrow will only pass on the email address generated by Tomorrow for the login as well as your name to these service providers. In addition, the service providers process further personal data that is generated during the use of the services, e.g. in connection with video conferencing or when using the chat functions. You can voluntarily provide further information, e.g. deposit your photo in Slack. However, this is not required.
Tomorrow has entered into a DPA with Google.
Slack
For cooperation and communication between students and between teachers and students, the platform Slack, a service of Slack Technologies Limited, One Park Place, 4th Floor, Hatch Street, Dublin 2, Ireland, (hereinafter "Slack") is integrated. Tomorrow only shares the email address generated by Tomorrow for the login as well as your name with these service providers. In addition, the service providers process further personal data that is generated when using the services, e.g. in connection with video conferencing or when using the chat functions. You can voluntarily provide further information, e.g. deposit your photo in Slack. However, this is not required.
Tomorrow has entered into an DPA with Slack.
Auth0
For identity and access management, the service Auth0 of Auth0 Inc, 10800 NE 8th St Ste 700, Bellevue, WA 98004, USA (hereinafter "Auth0") is used, which offers a so-called single sign-on functionality. Hereby, the email address generated by Tomorrow for registration is processed. Tomorrow has concluded a DPA with Auth0, including EU standard contractual clauses for the use of Auth0. Through this contract, Auth0 assures that they process the data in accordance with the GDPR and ensure the protection of the rights of the data subject.
HubSpot
In order to communicate with you as part of the application process and to optimize Tomorrow’s Services as part of the application process, Tomorrow uses HubSpot, a service provided by HubSpot Germany GmbH, Am Postbahnhof 17, 10243 Berlin, Germany ("HubSpot"). HubSpot, on behalf of Tomorrow and at Tomorrow's direction, processes your name, email address, telephone number, date of birth, application materials, information about your use of the Tomorrow website, and other data in connection with your interaction with Tomorrow's services and as part of your application to Tomorrow. This information is stored on servers operated by HubSpot. Tomorrow has entered into a DPA with HubSpot. Through this agreement, HubSpot assures that they process the data in accordance with the GDPR and ensure the protection of the rights of the data subject. For more information on data processing by HubSpot, please visit https://legal.hubspot.com/de/privacy-policy.
V. Duration of storage
Tomorrow processes and stores your personal data to the extent necessary to achieve the purposes or to comply with legal obligations. Therefore, Tomorrow stores the data for the duration of the University Course and after termination only to the extent and for as long as required by law, relying on Tomorrow's internal deletion policy. If the data is no longer required to achieve the purpose or to fulfill legal obligations (e.g. tax or commercial law), it will be automatically deleted, unless further processing is required to preserve evidence or to defend legal claims against Tomorrow. Tomorrow deletes the data of rejected applicants after six months.
VI. Your rights under the GDPR
Under the GDPR, you can exercise the following rights against the joint controllers:
Your right to information and disclosure pursuant to Art. 15 GDPR, in particular, you may request information about the processing purposes, the category of personal data, the categories of recipients to whom your data have been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right of complaint, the origin of your data, if not collected by Tomorrow, as well as the existence of automated decision-making, including profiling, and, if applicable, meaningful information about its details.
Your right to rectification according to Art. 16 GDPR, e.g. if your data is incomplete or incorrect, you can request Tomorrow to correct it.
Your right to erasure pursuant to Art. 17 GDPR, if this is not (any longer) necessary for the exercise of the right to freedom of expression and information, for the fulfillment of a legal obligation, for reasons of public interest or for the assertion, exercise or defense of legal claims.
Your right to restriction of processing pursuant to Art. 18 GDPR. You may request that your data be blocked, e.g. because you believe the data to be inaccurate or the processing to be unlawful, but you object to its erasure because you need it to assert, exercise or defend legal claims or you have objected to the processing pursuant to Art. 21 GDPR.
Your right to data portability according to Art. 20 GDPR. You may request that Tomorrow transfers data you have provided to us in a structured, commonly used and machine-readable format to you or to another controller.
Finally, you also have the right to lodge a complaint with the competent data protection supervisory authority (Art. 77 GDPR). You can file this complaint both at your place of residence, at your place of work or at the place of the data protection violation you are complaining about. You can also file a complaint with the supervisory authority at our registered offices.
In addition, you can also revoke a given consent at any time. However, this revocation only applies for the future. Any processing that took place before the revocation remains unaffected. If you wish to exercise your rights as a data subject, you may also do so by contacting privacy@tomorrowseducation.com.
VII. Information about your right to object according to Art. 21 GDPR
In addition to the rights already mentioned, you have the right to object to the processing of your personal data at any time on grounds relating to your particular situation, provided that such processing is carried out on the basis of Art. 6 (1) lit. f) GDPR (data processing on the basis of a balance of interests). If you object, Tomorrow will no longer process your personal data unless we can demonstrate circumstances that override your interests, rights and freedoms and therefore justify the processing.
You also have the right to object at any time to the processing of your personal data for the purpose of direct marketing (including the subscription to our newsletter) without incurring any costs other than the transmission costs according to the prime rates; this also applies to the creation of a user profile (so-called "profiling"), insofar as this is associated with direct marketing. If you object, Tomorrow will no longer process your personal data in the future.
Please note that you may not be able to use the website or Services, or may only be able to use them to a limited extent, if you do not provide us with certain data or if you object to the use of this data. The objection can be submitted informally to privacy@tomorrowseducation.com.
VIII. The use of cookies, web analytics and other tracking tools
When using the Tomorrow website and the Services of Tomorrow, usage data is collected in the context of so-called "web tracking". This means that the behavior of certain users can be tracked pseudonymously to improve our services, personalize and optimize the display of advertising. Tomorrow also uses cookies for this purpose.
What are cookies? Cookies are small text files containing information that are stored on your access device. They are usually used to associate a user with a particular action or preference on a website, but without identifying the user as a person or revealing their identity.
Cookies are not automatically good or bad, but it is worth understanding what you can do about them and making your own decision about your data.
Tomorrow uses the following types of cookies on the Website, the scope and functionality of which are explained below: Session Cookies and Persistent Cookies.
Session cookies are automatically deleted when you close your browser. This applies in particular to session cookies. They store a so-called session ID, with which various requests of your browser can be assigned to the common session. This allows your computer to be recognized when you return to the Tomorrow website. Session cookies are deleted when you log out or close your browser.
Persistent cookies are also initially stored when you close your browser, and then automatically deleted after a certain period of time, which may vary depending on the cookie. You can delete the cookies at any time in the security settings of your browser.
The use of cookies serves on the one hand to make the use of the Tomorrow offer more pleasant for you. We use so-called session cookies to recognize that you have already logged into your user account. These are automatically deleted after you leave the session.
In addition, Tomorrow also uses temporary cookies to optimize the user experience, which are stored for a certain period of time on your device. If you visit our site again to use our services, it is automatically recognized that you were already at Tomorrow and which entries and settings you have made, so that you do not have to enter them again.
The data processed by cookies are necessary for the aforementioned purposes to protect the legitimate interests of Tomorrow pursuant to Art. 6 (1) p. 1 lit. f GDPR. Most browsers accept cookies and pixels automatically. However, you can configure your browser so that no cookies are stored on your computer or a notice always appears before a cookie is created. However, the complete deactivation of cookies may mean that you cannot use all functions of the Tomorrow website. You can prevent the use of pixels on our pages by using appropriate tools or browser add-ons (e.g. the add-on "AdBlock" for the Firefox browser).
Cookies based on your voluntary consent in Consent Management
Hotjar
On the other hand, Tomorrow uses Art. 6 para. 1 p. 1 lit. a GDPR-cookies and pixel tags from Hotjar, if you have explicitly agreed via our Consent Management Tool, in order to statistically record the use of our platform and for the purpose of optimizing our offer. The provider is Hotjar Ltd, Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 1000, Malta, Europe (website: https://www.hotjar.com).
You can revoke your consent at any time with effect for the future. In the description in section 7, we explain how to revoke your consent.
With Hotjar we can record your mouse and scroll movements and clicks, among other things. Hotjar can also determine how long you have remained with the mouse pointer on a certain spot. From this information, Hotjar creates so-called heat maps, which can be used to determine which offers are viewed preferentially.
Furthermore, we can determine how long you stayed on a page and when you left it. We can also determine at which point you abandoned your entries in a contact form (so-called conversion funnels).
You can get comprehensive information about each cookie we use in our Consent Manager.
.png)
.svg)
.svg)
.svg)
