Privacy Policy

Datenschutzerklärung

1. Controller

The controller responsible for data processing on this website under the GDPR is:

[Full name or company name and legal form]
[Street and house number]
[Postal code and city]
Germany
Email: contact@scholarway.net

We are not required to appoint a data protection officer. For any privacy question, write to the address above.

2. Summary

• This website sets no cookies and stores nothing in your browser.
• There is no analytics, tracking, advertising or social media plugin.
• Fonts are served from our own server; your browser makes no requests to Google.
• We only process personal data when you visit the site (technical server logs) and when you choose to send us a message or subscribe to the newsletter.

3. Hosting and server log files

This website is hosted by [Hosting provider name and address]. When you open a page, your browser automatically transmits information that is recorded in server log files: IP address, date and time of the request, requested page, referrer URL, browser type and version, and operating system.

We process this data to deliver the website and to keep it secure and stable, for example to detect and fend off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and error-free operation of the website. The log files are deleted after [e.g. 14 days], unless a security incident requires keeping them longer for investigation. We have concluded a data processing agreement with the hosting provider under Art. 28 GDPR.

The connection to this website is encrypted with TLS (recognisable by “https://” in the address bar).

4. Contact form and email

When you use the contact form or write to us by email, we process your name, email address, subject and message in order to answer your enquiry. The form sends your message to our mailbox by email; it is not stored on the web server.

The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract or pre-contractual steps, and otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering the enquiries addressed to us. We delete your data once your enquiry has been fully dealt with, unless statutory retention obligations (for example under commercial or tax law) require us to keep it longer.

Our email is provided by [Email provider name and address], acting as our processor.

5. Newsletter

If you subscribe to our newsletter, we process your email address to send it to you and, if you provide it, your first name to address you personally. The legal basis is your consent under Art. 6(1)(a) GDPR, which you give by submitting the form. You can withdraw your consent at any time with effect for the future, via the unsubscribe link in every newsletter or by email to contact@scholarway.net. The lawfulness of processing before withdrawal is not affected.

Double opt-in: after you submit the form you receive an email asking you to confirm your subscription. You are only added to the newsletter once you click the confirmation link. This makes sure nobody can subscribe an address that is not theirs. To be able to prove your consent, the time of the signup and of the confirmation and the IP address used are recorded.

Newsletter service: we manage the newsletter list and send the newsletter with Zoho Campaigns, a service of Zoho Corporation B.V., Beneluxlaan 4B, 3527 HS Utrecht, Netherlands, which processes the data on our behalf under a data processing agreement (Art. 28 GDPR). Your data is stored in Zoho's data centres in the European Union. We do not track whether our newsletters are opened or which links are clicked.

Together with your signup we record which link brought you to the form: its placement, the post it appeared in, the type and theme of that content and the channel (for example a social network). This information comes from the address of the link you followed, not from your device, and involves no cookies or tracking. We use it to understand which of our content leads to subscriptions. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in evaluating the reach of our content; it is stored with your subscription and deleted with it.

We keep your email address for as long as you are subscribed. After you unsubscribe we delete it, except that we may keep a record of your consent and withdrawal for up to three years to be able to prove that it was given (Art. 6(1)(f) GDPR in conjunction with Art. 7(1) GDPR).

6. Spam protection with Cloudflare Turnstile

To protect our forms against automated abuse we use Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. When a page with a form loads, Turnstile evaluates technical characteristics of your browser and your IP address to tell humans from bots. Turnstile does not set cookies for advertising or tracking.

The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in protecting the forms against spam and abuse; any access to information on your device is strictly necessary for this security function (§ 25(2) no. 2 TDDDG). Data may be transferred to the USA. Cloudflare is certified under the EU-US Data Privacy Framework, on the basis of which the European Commission has issued an adequacy decision (Art. 45 GDPR). More information: cloudflare.com/privacypolicy.

7. Your rights

Regarding your personal data, you have the right to:

• access (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdraw any consent you have given, with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): where we process your data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

To exercise these rights, write to contact@scholarway.net. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence or place of work. The authority responsible for us is: [Name and address of the data protection authority of your federal state].

8. No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR. Providing your data is neither legally nor contractually required; without it we simply cannot answer your enquiry or send you the newsletter.