The Goethe-Institut e.V., Oskar-von-Miller-Ring 18, 80333 Munich, Germany ("Goethe-Institut" or "We"), as the provider of services (particularly the booking of distance and class-based courses and examinations), is the responsible body for the personal data related to the course, or examination participant ("you"), within the meaning of the EU General Data Protection Regulation (GDPR) and German data protection regulations, in particular, the Federal Data Protection Act (BDSG).
Content
1. DATA COLLECTION AND USE FOR CONTRACT EXECUTION
2. DATA COLLECTION AND USE FOR THE PURPOSES OF DIRECT ADVERTISING
a) Postal advertising
b) Email newsletters
3. DATA TRANSFER TO THIRD PARTIES
4. DATA PROTECTION
5. YOUR RIGHTS AND DATA PROTECTION CONTACT INFORMATION
6. RIGHT TO OBJECTION
The Goethe-Institut takes the protection of your data very seriously. With this privacy policy we would like to inform you transparently about which personal data ("your data") we collect, process, and use process and use, if you register for a course and / or exam at the Goethe-Institut.
1. DATA COLLECTION AND USE FOR CONTRACT EXECUTION
We collect personal data if you provide it to us when contacting us (e.g. by contact form or email), or during a course, or exam booking. The specific data collected in detail, as well as the information which is mandatory and that which is voluntary, can be found in the respective input forms.
In these cases, we collect and process the data you have provided for the purpose of carrying out the respective contract, for example, to conduct a placement test for your language courses, or complete a language course including a subsequent examination, as well as to process your inquiries in accordance with Art. 6 (1) lit. b GDPR. Insofar as you have expressly consented to the processing of special data categories in accordance with Art. 9 (2) lit. a GDPR, we collect your health data (e.g. allergies) only for the purpose of which you are informed when granting consent.
After completion of the respective contract, your data will be blocked for further use and deleted after expiry of the tax and commercial retention periods. If statutory fiscal or commercial data retention requirements for individual data do not apply, your information will be deleted immediately after the respective contract has been executed. Any other state of affairs is only valid if you have expressly consented to a further use of your data or if we reserve the right to further data usage, this being permitted by law and of which we will inform you below.
Data transfer for contract execution
As part of the course and examination booking, your personal data is processed in our central language course management system, which is accessible to other Goethe-Instituts within the European Union or the European Economic Area. This is done to execute the contract in accordance with Art. 6 (1) sentence 1 lit. b GDPR and to safeguard our legitimate interests in valid information and correct data records when booking a course in accordance with Art. 6 (1) sentence 1 lit. f GDPR.
For fulfilment of the contract, we will pass on your data to the shipping company commissioned with the delivery, insofar as this is necessary for the delivery of ordered goods. Depending on which payment service provider you select in the order process, we will forward the payment data collected to the credit institution commissioned with the payment and any payment service providers commissioned by us to process the payments or to the selected payment service. In part, the selected payment service providers will also collect this data themselves, provided that you create an account there. In this case, you must log in to the payment service provider with your access data during the ordering process. In this respect, the privacy policy held by the respective payment service provider applies.
As part of the execution of our contracts with you, for example, through the provision of language courses, we pass your data in part to service providers who process them on our behalf and within the framework of a contract between the Goethe-Institut and the respective service provider for order processing. Such a service provider may, for example, be the provider of a software that the Goethe-Institut uses for contract execution.
2. DATA COLLECTION AND USE FOR THE PURPOSES OF DIRECT ADVERTISING
a) Postal advertising
We reserve the right to use your first and last name, and your postal address for our own advertising purposes, e.g. to send you interesting offers and information about our products by post. This serves to safeguard our legitimate interests, which are predominantly justified in the interests of weighing up our interests, in a promotional approach to our customers in accordance with Art. 6 (1) lit. f GDPR. You can object to the storage and use of your data for these purposes at any time by sending a message to datenschutz@goethe.de.
b) Email newsletters
If you subscribe to one of our newsletters, we will use the information required or separately provided by you to periodically send you the email newsletter to which you have subscribed. The sending of email newsletters takes place on the basis of your separate explicit consent as per Art. 6 (1) lit. a GDPR. For security reasons, we use the so-called double opt-in procedure: we will only send you a newsletter by email if you have previously confirmed your newsletter subscription. For this purpose, we will send you an email confirming the subscription via the link contained therein. We want to make sure that only you as the owner of the specified email address can subscribe to the newsletter.
The newsletter is sent as part of a processing order on our behalf by a service provider, to which we pass on your email address.
You may object to this use of your email address at any time by sending a message to the contact details provided below or through a dedicated link in the email message, without incurring any costs other than the transmission costs according to the basic tariffs.
3. DATA TRANSFER TO THIRD PARTIES
a) Data transfer to Goethe-Instituts
In the event that you are excluded from an examination by the Goethe-Institut due to one of the reasons stated in the examination regulations, the Goethe-Institut will impose a one-year block exempting you from the exam portfolio of the Goethe-Institut worldwide; for the purpose of enforcing this measure (checking compliance with an imposed test ban), your data will be passed on to the Goethe-Institut examination centres (see § 2 of the Examination Regulations) worldwide and processed there. This is done on the basis of the execution of the joint contract to provide an examination pursuant to Art. 6 (1) lit. b GDPR. To the extent that personal data processing takes place in countries outside the European Union or the European Economic Area, this is also based on the necessity of data transfer for the execution of this contract.
b) Data transfer to the central examination archive
If you have consented to it in accordance with Art. 6 (1) sentence 1 lit. a GDPR, for the purpose of checking the authenticity of and issuing replacement certificates, data relating to the examinations you have taken will be stored and used in the central examination archive (for a maximum of 10 years). No further transmission of your personal data to third parties for purposes other than those listed above takes place.
4. DATA PROTECTION
We protect our systems and data processing processes with comprehensive technical and organisational measures against the loss of, destruction of, access to, modification or dissemination of your data by unauthorised persons
5. YOUR RIGHTS AND DATA PROTECTION CONTACT INFORMATION
As a data subject, you have the following rights:
- according to Art. 15 GDPR, you have the right to demand information on the personal data processed by us in the scope specified therein;
- in accordance with Art. 16 GDPR, you have the right to demand without delay the correction of incorrect personal data or completion of personal data stored with us;
- according to Art. 17 GDPR, you have the right to demand the deletion of your personal data stored by us, unless further processing is required to exercise the right to freedom of expression and information;
- to fulfil a legal obligation;
- for reasons of public interest or to assert, exercise or defend legal claims;
- according to Art. 18 GDPR, you have the right to demand the restriction of the processing of your personal data, insofar as the accuracy of the data is disputed by you;
- the processing is illegal, but you reject its deletion;
- we no longer need the data, but you need it for asserting, exercising or defending legal claims, or you have filed an objection against the processing in accordance with Art. 21 GDPR;
- according to Art. 20 GDPR, you have the right to receive your personal data, which you have provided to us, in a structured, common, and machine-readable format, or to request the transfer to another responsible party;
- according to Art. 77 GDPR, you have the right to complain to a supervisory authority. As a rule, you can contact the supervisory authority of your usual place of residence or work, or our company headquarters.
If you have any questions regarding the collection, processing or use of your personal data, information, correction, restriction of processing or deletion of data, and revocation of any consent granted or objection to a particular use of data and the right to data portability, please contact our company Data Protection Officer:
The Data Protection Officer
Goethe-Institut e.V.
Oskar-von-Miller-Ring 18
80333 Munich
Germany
datenschutz@goethe.de
6. RIGHT TO OBJECTION
To the extent that we process personal data as explained above in order to safeguard our legitimate interests, which are predominant in the context of a weighing up of interests, you can object to this processing with effect for the future. If the processing is for the purpose of direct marketing, you can exercise this right at any time as described above. Insofar as the processing takes place for other purposes, you are only entitled to a right of objection if there are reasons that arise from your particular situation.
After exercising your right to object, we will not further process your personal data for these purposes, unless we can demonstrate compelling legitimate grounds for processing that outweigh your interests, rights and freedoms, or if the processing serves the assertion, exercise or defence of legal claims.
This does not apply if the processing is for direct marketing purposes. In that case we will not process your personal data for this purpose.
