Data Privacy Statement

The controller responsible for data processing is:
Deutscher Akademischer Austauschdienst e.V.
Kennedyallee 50
53175 Bonn
Contact: datenschutz@daad.de

You can contact our Data Protection Officer as follows:
Dr. Gregor Scheja
Scheja & Partners GmbH & Co. KG
Adenauerallee 136
53113 Bonn
Telephone: 0228/2272260
Contact: https://www.scheja-partner.de/en/contact/contact.html

As a data subject, you have the following rights under the General Data Protection Regulation (GDPR), provided that the respective legal requirements are met:

Access: You have the right to obtain information about the data processed about you.

Rectification: You may request the rectification of inaccurate data concerning you. You may also request the completion of incomplete data.

Erasure: In certain cases, you may request the erasure of your personal data.

Restriction of processing: In certain cases, you may request that the processing of your data be restricted.

Data portability: If you have provided data on the basis of a contract or consent, you may request that you receive the data you have provided in a structured, commonly used and machine-readable format or that it be transmitted to another controller.

Right to object

Right to object on grounds relating to your particular situation
You have the right, on grounds relating to your particular situation, to object at any time to the processing of your personal data carried out on the basis of Article 6(1), subparagraph 1, point (e) GDPR or Article 6(1), subparagraph 1, point (f) GDPR; this also applies to profiling based on these provisions. This personal data will then no longer be processed for these purposes unless compelling legitimate grounds for the processing can be demonstrated which override your interests, rights and freedoms, or unless the processing serves to establish, exercise or defend legal claims.

Right to object to the processing of data for direct marketing purposes
In individual cases, your data will be processed for direct marketing purposes. You have the right to object at any time to the processing of personal data concerning you for the purposes of such advertising. This also applies to profiling insofar as it is associated with such direct marketing. If you object to processing for direct marketing purposes, your personal data will no longer be processed for these purposes.

Withdrawal of consent: If you have given consent to the processing of your data, you may withdraw it at any time with effect for the future. The lawfulness of the processing of your data up to the time of withdrawal remains unaffected. In addition to the methods specified under „Exercising your rights“, you may also declare a withdrawal in accordance with the respective information on „Exercising withdrawal“ in the „Services & Cookies“ section.

Exercising your rights: To exercise any of the rights mentioned above, please contact datenschutz@daad.de or write to the address stated above under section 1. Please ensure that we are able to clearly identify you.

Right to lodge a complaint with the supervisory authority: You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement, if you believe that the processing of personal data concerning you is unlawful.

Automated individual decisions, including profiling within the meaning of Article 22 GDPR, do not take place in connection with the use of our service. However, a form of profiling within the meaning of Article 4 No. 4 GDPR does take place. In this process, the information you provide (in particular regarding interests, language skills, intended degree and other preferences) is processed automatically in order to suggest and prioritise personalised study programmes, preparatory courses, language courses and other content for you. This profiling serves exclusively to improve the content-based fit of the offers displayed and has no legal effects or similarly significant adverse effects for you.

5.1 Own services

5.1.1 General

a) Description of the service:

• Data categories: Date and time of access, duration of the visit, type of end device, operating system used, the functions you use, volume of data sent, type of event, IP address, domain name
• Purpose(s): Provision of the service
• Legal basis/bases: Article 6(1)(b) and (f) GDPR
• Where applicable, legitimate interests pursued: Technical functionality
• Recipients or categories of recipients: Internal departments, hosting provider, external service providers for technical support
• Third-country transfer; adequacy decision (yes/no): —
• Where applicable, safeguards for third-country transfers and how to access them: —
• Retention periods or criteria for determining them: Immediately after delivery by the web server
• Obligation to provide the personal data and, where applicable, consequences of not providing it: No obligation to provide; automated collection when the service is accessed
• Where applicable, exercise of withdrawal: —
• Source of the data: Direct collection when the website/service is accessed

b) Log files:

• Data categories: URL accessed, user’s IP address, time and date of access, amount of data transferred, website from which the user reached the requested page (so-called „referrer“), websites accessed by the user’s system via our website, HTTP status, information about the browser type and version used, user’s operating system, user’s internet service provider
• Purpose(s): Statistical analyses, improvement of the website, system security (e.g. prevention of misuse), error diagnosis
• Legal basis/bases: Article 6(1)(b) and (f) GDPR
• Where applicable, legitimate interests pursued: see purposes
• Recipients or categories of recipients: Internal departments, hosting provider, external service providers for technical support, government authorities upon request
• Third-country transfer; adequacy decision (yes/no): —
• Where applicable, safeguards for third-country transfers and how to access them: —
• Retention periods or criteria for determining them: 7 days after creation
• Obligation to provide the personal data and, where applicable, consequences of not providing it: No obligation to provide; automated collection when the service is accessed
• Where applicable, exercise of withdrawal: —
• Source of the data: Direct collection when the website/service is accessed

5.1.2. Degree programme search without registration

• Data categories: Field of interest, desired degree, desired language of instruction
• Purpose(s): Conducting the search according to the specified criteria
• Legal basis/bases: Article 6(1)(b) GDPR
• Where applicable, legitimate interests pursued: —
• Recipients or categories of recipients: Internal departments, hosting provider, external service providers for technical support
• Third-country transfer; adequacy decision (yes/no): —
• Where applicable, safeguards for third-country transfers and how to access them: —
• Retention periods or criteria for determining them: Duration of the session; if registration takes place, the data is transferred to the user profile, see section 5.1.3a
• Obligation to provide the personal data and, where applicable, consequences of not providing it: No obligation to provide
• Where applicable, exercise of withdrawal: —
• Source of the data: Direct collection when the questions are answered

5.1.3. Personalised use of the Study Guide Germany portal

a) Registration for the Study Guide Germany portal / Study Guide Wizard

• Data categories: Transfer of the data specified under section 5.1.2 (field of interest, desired degree, desired language of instruction) as well as first name, last name, email address, password, salutation, preferred language, ID; in addition, the following data is collected during the initial configuration (Study Guide Wizard): type of language skills, language level, interest in preparatory courses, selection of additional service offers (e.g. studying with a child, studying with a disability)

• Purpose(s): Registration for the Study Guide Germany portal by means of a DAAD ID, performance of a personalised content configuration of the Study Guide, as well as automated pre-filtering and prioritisation of suitable content and offers

  You can find further information in connection with the DAAD ID in the „Mein DAAD“ Privacy Policy.

• Legal basis/bases: Article 6(1)(b) GDPR; where health data is processed, Article 6(1)(a) and Article 9(2)(a) GDPR

• Where applicable, legitimate interests pursued: —

• Recipients or categories of recipients: Internal departments, hosting provider, external service providers for technical support

• Third-country transfer; adequacy decision (yes/no): Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA; no

• Where applicable, safeguards for third-country transfers and how to access them: EU Standard Contractual Clauses, consent

• Retention periods or criteria for determining them: After deletion of the account by the user and a manual review by a DAAD employee confirming that no other DAAD services are linked to the account

• Obligation to provide the personal data and, where applicable, consequences of not providing it: Registration is not possible without providing the data

• Where applicable, exercise of withdrawal: —

• Source of the data: Direct collection during registration or when searching for study offers (see section 5.1.2)

b) Study Guide Germany profile, watchlist, Study Guide, requests sent

• Data categories: Nationality, country of origin, country of residence, preliminary result for higher education entrance eligibility, most recently obtained qualification, country of the most recently obtained qualification, subject group of the most recently obtained qualification, degree of your studies, subject of your studies, degree programme of your studies, higher education institution of your studies, German language level, English language level, preferred field of study, intended degree, preferred course language, watchlist of higher education institutions, requests sent to higher education institutions (see section 5.1.3 c), information in the Study Guide including any notes (heading, text); detailed preferences from the Study Guide Wizard (see section 5.1.3 a above)
• Purpose(s): Search for personalised study offers; personalised provision, progress management and optimisation of individual preparation for studying in Germany
• Legal basis/bases: Article 6(1)(b) GDPR
• Where applicable, legitimate interests pursued: —
• Recipients or categories of recipients: Internal departments, hosting provider, external service providers for technical support
• Third-country transfer; adequacy decision (yes/no): —
• Where applicable, safeguards for third-country transfers and how to access them: —
• Retention periods or criteria for determining them: Generally deleted after removal by the user or deletion of the account
• Obligation to provide the personal data and, where applicable, consequences of not providing it: No obligation to provide.
• Where applicable, exercise of withdrawal: —
• Source of the data: Direct collection in the user profile

c) Contacting a higher education institution via Study Guide Germany

• Data categories: Request, first name, last name, nationality, email address, most recently obtained qualification, degree of your studies, German language level, English language level, intended degree, desired start of studies, message to the higher education institution (mandatory fields); country of residence, country of the most recently obtained qualification, subject group of the most recently obtained qualification, subject of your studies, degree programme of your studies, higher education institution of your studies, preliminary result for higher education entrance eligibility (not mandatory fields)
• Purpose(s): Contacting selected higher education institutions
• Legal basis/bases: Article 6(1)(b) GDPR
• Where applicable, legitimate interests pursued: —
• Recipients or categories of recipients: Internal departments, hosting provider, external service providers for technical support, selected higher education institutions
• Third-country transfer; adequacy decision (yes/no): Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA; no
• Where applicable, safeguards for third-country transfers and how to access them: EU Standard Contractual Clauses, consent
• Retention periods or criteria for determining them: Deletion after the user has deleted the contact request to the higher education institution or the user’s account
• Obligation to provide the personal data and, where applicable, consequences of not providing it: Mandatory information in the contact form is marked with „*“; otherwise request cannot be sent
• Where applicable, exercise of withdrawal: —
• Source of the data: Direct collection in the contact form

d) Scholarship search

• Data categories: Country of origin, preferred field of study, intended degree, preferred course language (not mandatory fields)
• Purpose(s): Search for personalised scholarship programmes
• Legal basis/bases: Article 6(1)(b) GDPR
• Where applicable, legitimate interests pursued: —
• Recipients or categories of recipients: Internal departments, hosting provider, external service providers for technical support
• Third-country transfer; adequacy decision (yes/no): —
• Where applicable, safeguards for third-country transfers and how to access them: —
• Retention periods or criteria for determining them: Generally deleted after removal by the user or deletion of the account
• Obligation to provide the personal data and, where applicable, consequences of not providing it: No obligation to provide
• Where applicable, exercise of withdrawal: —
• Source of the data: Direct collection in the user profile

e) Geo-location service

• Data categories: Geocoordinates (determined from the IP address or due to manual change of the city name), based on this city name, country ID
• Purpose(s): Display of the physically nearest DAAD contact point
• Legal basis/bases: Article 6(1)(f) GDPR
• Where applicable, legitimate interests pursued: see purpose
• Recipients or categories of recipients: Internal departments, hosting provider, external service providers for technical support
• Third-country transfer; adequacy decision (yes/no): —
• Where applicable, safeguards for third-country transfers and how to access them: —
• Retention periods or criteria for determining them: Storage of the determined or manually selected location until the account is deleted
• Obligation to provide the personal data and, where applicable, consequences of not providing it: No obligation to provide
• Where applicable, exercise of withdrawal: —
• Source of the data: Direct collection in the user profile

f) Language tests (g.a.s.t.)

• Data categories: Identification data (email address, name, user ID/DAAD ID), booking and test data (test date, test results, procedure and status data); transmitted test results
• Purpose(s): Carrying out language placement tests and transmitting the test results to improve the suitability of study offers and language courses
• Legal basis/bases: Article 6(1)(b) GDPR
• Recipients or categories of recipients: g.a.s.t. (Society for Academic Study Preparation and Test Development), internal departments, hosting provider, external service providers for technical support

  Note: tests are carried out by g.a.s.t. under its own responsibility. Please refer to the g.a.s.t. data protection information for supplementary information.

• Third-country transfer; adequacy decision (yes/no): —
• Where applicable, safeguards for third-country transfers and how to access them: —
• Retention periods or criteria for determining them: Storage of the transmitted test results until deletion of the account; otherwise, storage by g.a.s.t. in accordance with its requirements
• Obligation to provide the personal data and, where applicable, consequences of not providing it: No obligation to provide
• Where applicable, exercise of withdrawal: —
• Source of the data: Direct collection in the context of test performance

5.1.4. Counselling by network staff members

a) Creation of a Study Guide Germany counselling data record by a counsellor

• Data categories: Mandatory component of a counselling data record: email address; optional content when creating a counselling data record: first name, last name, profile data, preliminary result for higher education entrance eligibility, watchlist, notes, code for transferring the counselling data, Study Guide configuration, new data in the user profile; additional automatically added content of a counselling data record: status (counselling not sent, sent, redeemed, expired), type (personal counselling, email), timestamp of email dispatch, timestamp of the last change, ID of the counsellor, source (counselling), content categories of the counselling (Study Guide configured yes/no, eligibility check completed yes/no, number of entries on the watchlist, number of notes;
• Purpose(s): Creation of a counselling data record by a counsellor following an active request from the prospective student
• Legal basis/bases: Article 6(1)(b) GDPR
• Where applicable, legitimate interests pursued: see purpose
• Recipients or categories of recipients: Internal departments (in particular the person providing the counselling), hosting provider, external service providers for technical support
• Third-country transfer; adequacy decision (yes/no): —
• Where applicable, safeguards for third-country transfers and how to access them: —
• Retention periods or criteria for determining them: Deletion after removal of the counselling data record by the counsellor or after a deletion request by the person interested in studying; otherwise, deletion six months after creation of the counselling data record.
• Obligation to provide the personal data and, where applicable, consequences of not providing it: This function cannot be used without recording the email address.
• Where applicable, exercise of withdrawal: —
• Source of the data: Direct collection through an active request by the person interested in studying and provision of data

b) Creation of a Study Guide Germany counselling data record by registered user

• Data categories: Profile data, preliminary result for higher education entrance eligibility, watchlist, code for transferring the counselling data, source (interest in studying), Study Guide configuration, new data in the user profile
• Purpose(s): Creation of a counselling data record by a registered user for use in a counselling session
• Legal basis/bases: Article 6(1)(b) GDPR
• Where applicable, legitimate interests pursued: see purpose
• Recipients or categories of recipients: Internal departments (in particular the person providing the counselling), hosting provider, external service providers for technical support
• Third-country transfer; adequacy decision (yes/no): —
• Where applicable, safeguards for third-country transfers and how to access them: —
• Retention periods or criteria for determining them: Automatically deleted after expiry of validity (14 days)
• Obligation to provide the personal data and, where applicable, consequences of not providing it: No obligation to provide
• Where applicable, exercise of withdrawal: —
• Source of the data: Direct collection through an active request by the person interested in studying and provision of data

5.2. Map service

In order to provide map material on our website, we use maps from the OpenStreetMap service (https://www.openstreetmap.de/). OpenStreetMap is an open-source mapping tool offered by the OpenStreetMap Foundation (OSMF) on the basis of the Open Data Commons Open Database License (ODbL). In order for the map to be displayed to you, you must first click „Show map“; only then will your IP address be forwarded to OpenStreetMap. Your data is processed in this respect on the basis of your consent (Art. 6(1)(a) GDPR).
Further information on the processing of your data can be found on the OpenStreetMap privacy page:
here https://wiki.openstreetmap.org/wiki/DE:Datenschutz and
here https://wiki.openstreetmap.org/wiki/DE:Legal_FAQ.

5.3. Cookies

We use cookies on Study Guide Germany in order to provide a wide range of functions, make use more convenient and optimise our offers. Cookies are small text files generated by a web server and stored on your computer by the web browser used during your online visit.

Click here to change the cookie settings: Change cookie settings.

On the one hand, we use so-called „session cookies“. These are automatically deleted after the end of your browser session.

We also use long-term cookies which are primarily used to provide you, as a visitor to our website, with recurring settings on a permanent basis. This enables us to adapt our website individually to your wishes. Long-term cookies also enable us to analyse visitors‘ usage behaviour, but only within the validity period of the cookie.

We use Google Analytics with the „_anonymizeIp()“ extension. This means that your IP addresses are further processed in truncated form.

In addition, further cookies may also be set by the respective providers in connection with the integration of certain services (so-called „third-party cookies“).

If you do not wish cookies to be used, you can prevent cookies from being stored on your device by making the appropriate settings in your internet browser. Please note that this may restrict the functionality and scope of our offer. In addition, we will set certain cookies only if you have previously consented to this. You may also make use of separate options to object to certain cookies.