Privacy Policy
Last updated: 20 August 2026
The protection of your personal data is important to us. In this Privacy Policy, we inform you about which personal data Inside Culture Academy e.K. processes, the purposes for which this is done, which service providers and platforms we use, and which rights you have.
This Privacy Policy applies in particular to:
our website,
our contact and enquiry forms,
our online shop,
training courses, coaching sessions and events,
digital courses and learning services,
our community,
the CV upload and Talent Pool,
CareerSuccess Germany and other programmes,
the Professional Portal,
Candidate Journey content,
consent forms, and
our social media presences.
Additional privacy information may be provided for certain services or forms. This additional information specifies the present Privacy Policy for the relevant processing activity.
This Privacy Policy is intended to provide information. The mere use of our website or services does not constitute consent under data protection law. Where consent is required, we obtain it separately, voluntarily and for a specific purpose.
Controller
The controller responsible for processing personal data is:
Inside Culture Academy e.K.
Sebastian Wittig
Huchtinger Heerstraße 121
28259 Bremen
Germany
Telephone: +49 421 27717553
Email: info@inside-culture-academy.de
Please direct data protection enquiries and withdrawals of consent to:
datenschutz@inside-culture-academy.de
Data protection at a glance
We process personal data in particular when you:
visit our website,
contact us,
book or purchase a service,
participate in a training course, coaching session or digital learning service,
use our learning platform or community,
submit a CV or other documents,
register for our Talent Pool or a programme,
voluntarily participate in a professionally visible portal area,
participate in a Candidate Journey,
provide us with photographs or other content,
request a newsletter or other information, or
participate in a competition or special campaign.
Depending on how you use our services, we may process the following data in particular:
master data and contact details,
contract, booking and invoice data,
payment and transaction data,
communication data,
user account and access data,
usage and technical connection data,
learning and course progress,
qualification and application data,
community posts and reactions,
photographs and other content provided, and
records of consent and withdrawal.
Processing only takes place where a legal basis exists. This may be, in particular:
your consent pursuant to Article 6(1)(a) GDPR,
the performance of a contract or steps taken prior to entering into a contract pursuant to Article 6(1)(b) GDPR,
compliance with a legal obligation pursuant to Article 6(1)(c) GDPR, or
the pursuit of a legitimate interest pursuant to Article 6(1)(f) GDPR.
Visiting our website and server log data
When you access our website, technically necessary data are processed. These may include in particular:
IP address,
date and time of access,
page or file accessed,
volume of data transferred,
browser type and browser version,
operating system,
referrer URL, and
technical device and connection information.
The processing takes place in order to make the website technically available, ensure its stability and security, identify errors and prevent abusive access.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and reliable operation of our website.
Log data are deleted as soon as they are no longer required for these purposes. They may be stored for longer if there are specific indications of a security incident or if a statutory retention obligation applies.
We use IT and hosting service providers for the technical provision of our website. Where these providers process personal data on our behalf, the required data processing agreements are in place.
Domain management
We use united-domains GmbH, Germany, to register and manage our internet domain.
In this context, domain, contract, contact and technical administration data may be processed in particular.
Processing takes place for the performance of our contractual relationship with the provider and on the basis of our legitimate interest in the reliable administration of our internet domain pursuant to Article 6(1)(b) and (f) GDPR.
Cookies and similar technologies
Our website uses cookies and similar technologies.
Technically necessary technologies may be used where they are required to provide a digital service expressly requested by you, operate the website securely or store settings selected by you.
Where access to information on your terminal device is strictly necessary, such access takes place on the basis of Section 25(2) TDDDG. The subsequent processing of personal data takes place, depending on the purpose, in particular on the basis of Article 6(1)(b) or (f) GDPR.
Analytics, marketing and other technologies that are not technically necessary are generally only used after you have given your consent.
In these cases, the legal basis is Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.
You can change or withdraw your selection at any time via the cookie or privacy settings provided on our website. The withdrawal applies to the future.
Where we store the status of your consent, this serves as evidence of whether and when consent was given or withdrawn.
Google Analytics
Where you have given your consent, we use Google Analytics 4 to statistically analyse the use of our website.
The provider is Google Ireland Limited, Ireland.
Google Analytics may process information about the following activities in particular:
pages accessed,
time and duration of a visit,
device used,
browser and operating system,
approximate geographical origin,
interactions with our website,
source of a website visit, and
pseudonymous user and session identifiers.
According to Google, individual IP addresses are not logged or stored in Google Analytics 4. For access from the European Union, the IP address is used to determine an approximate geographical region and is then deleted.
Google Analytics is only activated if the required consent has been given.
The legal basis is Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.
The retention period for user and event data is determined by the settings we have selected in the Google Analytics property. We limit the retention period to the period required for statistical analysis. Aggregated statistics may remain available for longer, provided that they no longer have a direct personal reference.
You can withdraw your consent at any time via the cookie or privacy settings on our website.
Where data are processed outside the European Union or the European Economic Area, the provisions in the section “Data transfers outside the EU and the EEA” also apply.
Contacting us
If you contact us by email, contact form, telephone, social media or by other means, we process the data you provide.
These may include in particular:
name,
email address,
telephone number,
company or organisation,
content of your enquiry, and
documents or attachments submitted by you.
Where your enquiry relates to the preparation or performance of a contract, processing takes place on the basis of Article 6(1)(b) GDPR.
For other enquiries, processing takes place on the basis of our legitimate interest in processing and responding to your enquiry pursuant to Article 6(1)(f) GDPR.
Where you have expressly consented to a particular processing activity, Article 6(1)(a) GDPR is the legal basis.
The data are deleted when your enquiry has been completed and there are no statutory retention obligations, contractual requirements or legitimate reasons for further storage.
Communication, document management and automation
For communication, appointment scheduling, document management and internal workflows, we use the following services in particular, depending on the processing activity:
Google Workspace,
Microsoft 365 and Outlook,
Zoom,
Zapier, and
other required IT service providers.
In this context, contact, communication, appointment, contract and document data may be processed in particular.
Depending on the activity, processing takes place in particular on the basis of:
Article 6(1)(b) GDPR for the preparation or performance of a contract,
Article 6(1)(c) GDPR for compliance with legal obligations, or
Article 6(1)(f) GDPR on the basis of our legitimate interest in efficient and secure communication and organisation.
Where service providers process personal data on our behalf, the required data processing agreements are concluded.
Online meetings, training courses and coaching sessions
For online meetings, webinars, coaching sessions and training courses, we use Zoom or Microsoft-based communication solutions in particular, depending on the service.
The following data may be processed in particular:
name,
email address,
participant and appointment data,
technical connection data,
chat contributions,
voluntarily provided profile information, and
where applicable, image and audio data.
Processing generally takes place for the performance of the agreed or requested service pursuant to Article 6(1)(b) GDPR.
Recordings of images, audio or chat histories are only made where a legal basis exists and participants have been informed before the recording begins.
Where a recording is based on consent, that consent may be withdrawn with effect for the future.
Design and content creation
We use Canva, among other services, to create and design graphics, presentations, documents and communication materials.
Personal data are processed only to the extent necessary for the relevant content or purpose.
Depending on the processing activity, the legal basis is in particular:
Article 6(1)(b) GDPR for contractually required content,
Article 6(1)(f) GDPR for our general corporate communication, or
Article 6(1)(a) GDPR where personal content is published or edited on the basis of consent.
The relevant specific sections of this Privacy Policy also apply to Candidate Journey photographs and AI-assisted image editing.
Social media presences
We maintain presences on LinkedIn and Instagram in particular.
When you visit our social media profiles, the respective platform operators process personal data in accordance with their own privacy policies. This may also occur if you do not have your own account with the relevant platform.
We process in particular:
public profile information,
comments and reactions,
direct messages,
information from enquiries, and
aggregated statistics concerning the use of our profiles.
Depending on the activity, processing takes place to respond to enquiries, communicate, present our company and services, and provide information on professional topics.
Depending on the activity, the legal basis is Article 6(1)(b) or (f) GDPR. Our legitimate interest lies in public relations, communication and presenting our services.
We only publish Candidate Journey content, photographs and other personal content on social media where an appropriate legal basis exists, in particular separate consent.
Where we and a platform operator are joint controllers for certain statistical analyses, the agreements concluded with the relevant platform operator pursuant to Article 26 GDPR also apply.
Online shop, bookings and contracts
For bookings, orders and the performance of our services, we process in particular:
name and contact details,
billing address,
services booked or ordered,
contract and order data,
payment and transaction information, and
required communication data.
The legal basis is Article 6(1)(b) GDPR.
Where data must be retained due to tax, commercial or accounting regulations, further processing takes place on the basis of Article 6(1)(c) GDPR.
WooCommerce
Our online shop is operated using WooCommerce on our website.
WooCommerce is a shop system used within our own WordPress environment. In particular, order, contact, billing and transaction data are processed.
Inside Culture Academy e.K. is generally the controller responsible for data processing within our online shop.
Stripe
We use Stripe to process payments.
The provider for European customers is, in particular, Stripe Payments Europe, Ltd., Ireland.
Depending on the payment method selected, Stripe processes in particular:
name and contact details,
payment information,
transaction data,
billing information,
technical data, and
information for fraud and abuse prevention.
Complete credit card information is generally processed directly by Stripe and is not disclosed to us in full.
Processing takes place to carry out the payment and therefore for the performance of a contract pursuant to Article 6(1)(b) GDPR. Measures to prevent fraud and abuse may additionally be based on legitimate interests pursuant to Article 6(1)(f) GDPR.
Stripe may act as a processor or as an independent controller for individual processing activities.
Accounting and invoicing
For accounting, invoicing and tax documentation, we use Lexware Office, formerly lexoffice.
The provider is Haufe-Lexware GmbH & Co. KG, Germany.
The following data may be processed in particular:
master data,
contact details,
contract data,
invoice data,
payment information,
accounting records, and
tax-relevant information.
Processing takes place for the performance of contractual relationships pursuant to Article 6(1)(b) GDPR and for compliance with statutory retention and documentation obligations pursuant to Article 6(1)(c) GDPR.
Digital learning platform and community
We use Memberspot for our digital courses, learning services and community functions.
The provider is Memberspot GmbH, Germany.
The following data may be processed in particular:
name and email address,
user account and access data,
booked content,
course and learning progress,
test results,
certificate information,
posts, comments and reactions,
technical usage data, and
information concerning the use of the learning platform.
Processing takes place to provide the booked or agreed services on the basis of Article 6(1)(b) GDPR.
Memberspot processes personal data as a technical service provider on our behalf, unless a different allocation of roles applies to a specific processing activity.
Visibility within the community
If you voluntarily use posts, comments, likes or other community functions, these activities may be visible to other members of the relevant area.
Please do not publish the personal data of other persons, confidential information or content that you are not authorised to publish in community posts.
Depending on the service and your voluntarily selected portal participation, certain areas may also be accessible to selected professional cooperation partners, institutional stakeholders, potential employers and their authorised HR or recruitment representatives.
The specific provisions concerning the Professional Portal apply to this extended visibility.
Self-employed trainers and experts
For training courses, coaching sessions, webinars and other services, we sometimes work with self-employed trainers and experts.
Where necessary for the provision of a service, the following data may be processed or made available in particular:
name and contact details,
booking and appointment information,
information concerning the relevant assignment or programme, and
information required to provide the service.
The legal basis is generally Article 6(1)(b) GDPR.
The role under data protection law depends on the specific allocation of tasks and responsibilities.
Where a trainer processes personal data exclusively on our behalf and in accordance with our instructions, this takes place in compliance with Article 28 GDPR.
Where a person is independently responsible for certain processing activities, that person processes the relevant data as an independent controller. Where the purposes and means are determined jointly, joint controllership pursuant to Article 26 GDPR may exist.
All persons involved are required to maintain confidentiality and protect personal data.
CV upload and specific enquiries
You can submit a CV and other information to us via our website or other agreed channels for the assessment of a specific professional opportunity, programme or placement request.
The following data may be processed in particular:
name,
email address,
telephone number,
country of current residence,
LinkedIn profile,
professional status,
desired professional field,
availability,
residence and mobility information,
language skills,
information concerning studies and professional qualifications,
professional experience, and
information contained in your CV and attachments.
If you submit the data for the assessment of a specific position, placement service or programme participation requested by you, the necessary processing generally takes place in order to take pre-contractual steps at your request pursuant to Article 6(1)(b) GDPR.
No additional consent is required to process the specific enquiry, provided that the processing is necessary to take these pre-contractual steps.
Talent Pool
You will only be included in our Talent Pool if you have given separate consent.
The Talent Pool is used in particular to:
consider your profile for suitable future opportunities,
contact you regarding suitable positions, programmes or projects,
match your professional interests and qualifications with future enquiries, and
enable subsequent contact.
The legal basis is your consent pursuant to Article 6(1)(a) GDPR.
Consent to the Talent Pool is voluntary and is obtained separately from other purposes.
You can withdraw your consent at any time with effect for the future.
Information about positions and programmes
General information about job vacancies, programmes, training courses or other services is only sent where an appropriate legal basis exists.
Where you wish to receive such information by email or through comparable communication channels, we generally obtain separate consent pursuant to Article 6(1)(a) GDPR.
Consent to receive information and updates is obtained separately from:
processing a specific enquiry,
inclusion in the Talent Pool,
participation in the Professional Portal,
the Candidate Journey,
publication of photographs, and
AI-assisted image editing.
You can withdraw your consent at any time with effect for the future.
Disclosure in a specific employer or placement process
Inclusion in our Talent Pool or uploading a CV does not mean that your complete application documents or private contact details will be generally disclosed to companies or other third parties.
Disclosure to a specific potential employer or cooperation partner only takes place if:
you have requested a corresponding placement or application process,
disclosure is necessary for this specific process and Article 6(1)(b) GDPR applies,
you have consented to the specific disclosure, or
another statutory legal basis exists.
You will be informed about the specific recipient and the intended purpose, unless this is already clear from the process requested by you.
A potential employer generally processes the application data received under its own responsibility pursuant to data protection law.
Special categories of personal data in application documents
Please do not submit information concerning:
health,
disabilities,
ethnic origin,
religion or beliefs,
political opinions,
trade union membership,
sex life or sexual orientation,
genetic data, or
biometric data for the purpose of uniquely identifying a person,
unless this information is expressly required for the specific activity.
Where such data are nevertheless submitted to us, we process them only if an exception under Article 9(2) GDPR applies. Information that is not required may be deleted or disregarded during the assessment.
Data we receive from cooperation or recruitment partners
In individual cases, candidates may be referred to us by language schools, recruitment partners, educational providers, institutional cooperation partners or other placement partners.
In this context, we may receive the following data in particular:
name and contact details,
professional interests,
language level,
qualifications,
professional experience,
information concerning desired participation in a programme, and
information concerning a specifically requested placement process.
We only process such data if:
you have initiated the transfer yourself,
you have given appropriate consent to the partner,
the processing is necessary in order to take pre-contractual steps requested by you, or
another statutory legal basis exists.
When we first contact you directly, we inform you about the source of the data and the essential circumstances of the processing, unless you already have this information.
In these cases as well, inclusion in our general Talent Pool only takes place on the basis of separate consent.
Professional Portal and professional community areas
As part of certain programmes, participants may voluntarily take part in professionally visible portal and community areas.
Depending on the programme and the settings or consent options you have selected, the following information may be visible in particular:
first name or display name,
profile photograph,
qualifications and professional background,
language skills or language level,
professional experience,
intended vocational training or professional field,
posts, comments and reactions, and
learning and preparation activities, insofar as these have been approved for the relevant area.
Certain professional areas may be accessible to:
selected cooperation partners,
institutional partners and stakeholders,
potential employers, and
their authorised HR or recruitment representatives.
Institutional partners may receive access in order to learn about, support or evaluate our vocational training, preparation, integration or onboarding concepts.
Potential employers may gain insight into the professional preparation and development of candidates. Visible information may contribute to a company developing an interest in a candidate.
The legal basis is your separate consent pursuant to Article 6(1)(a) GDPR.
Data that are not visible
The following data in particular are not disclosed solely on the basis of your consent to participate in the Professional Portal:
private address,
private telephone number,
private email address,
identity documents,
residence documents,
certificates,
certificates of enrolment, and
complete application documents.
The disclosure of such information in a specific employer, application or placement process takes place separately and only on the basis of an appropriate legal basis.
Voluntary nature and alternative
Participation in professionally visible portal or community areas is voluntary.
If you do not consent to this visibility or withdraw consent that you have already given, you can generally continue to use the regular learning access provided for the relevant programme.
You will then simply not participate, or no longer participate, in the areas that are accessible to external professional visitors.
The withdrawal of consent to portal participation must not result in unrelated disadvantages regarding regular learning access.
Responsibility of professional visitors
Professional visitors are only given access to the areas intended for them.
Where a potential employer or another professional visitor uses visible information for its own selection, recruitment or contact decision, it may be independently responsible for this further processing under data protection law.
Using visible information for other purposes that are incompatible with the purpose of the portal requires a separate legal basis.
Candidate Journey
With separate consent, we may document the actual preparation, learning, integration and professional development of selected candidates and create Candidate Journey content from this information.
The purposes may include in particular:
documenting an actual development journey,
presenting learning and integration processes,
informing potential participants and partners,
public relations, and
communicating and marketing our programmes and methods.
Depending on the consent given, the following information may be used in particular:
first name,
information and statements previously provided to us,
language and learning progress,
training and preparation activities,
information about interviews and employer preparation,
relocation and arrival in Germany,
the beginning and development of vocational training or employment,
integration and development milestones,
interviews or quotations, and
photographs or other media provided.
Information may originate from previous information provided to Inside Culture Academy and from actual participation in our preparation, education and integration services.
The additional use of existing information for a Candidate Journey or its publication only takes place where an appropriate legal basis exists.
The legal basis is generally your separate consent pursuant to Article 6(1)(a) GDPR.
Consent may be obtained separately in particular for:
the use of existing information,
documenting future milestones,
the use of quotations or interviews,
the use of photographs,
publication through individual channels, and
AI-assisted image editing.
Participation in a Candidate Journey is voluntary and is not a requirement for regular learning or programme access.
Publication of Candidate Journey content
With the relevant consent, Candidate Journey content may be published in particular on:
the Inside Culture Academy website,
LinkedIn,
Instagram, and
other communication channels expressly stated in the relevant consent.
Publicly published content may:
be accessible worldwide,
be indexed by search engines,
be stored by third parties,
be shared or copied, and
be distributed beyond our sphere of influence.
Following subsequent deletion by Inside Culture Academy, we therefore cannot guarantee that all copies, screenshots, archives or republications previously created by third parties will also be deleted.
When content is published through LinkedIn, Instagram or other platforms, the respective platform operators also process personal data in accordance with their own privacy policies.
Photographs and the right to one’s own image
Photographs and other image material are only used where an appropriate legal basis exists.
Where publication is based on your consent, processing takes place on the basis of Article 6(1)(a) GDPR.
We also comply with the statutory requirements concerning the right to one’s own image, in particular Section 22 of the German Art Copyright Act, where applicable.
If you provide photographs to us yourself, you may only submit images for which you hold the necessary rights of use.
If other persons are recognisably depicted, their rights must also be taken into account and any required consent must have been obtained.
We do not use Candidate Journey photographs for biometric identification, biometric categorisation or emotion recognition.
AI-assisted image editing
With separate consent, we may use AI-assisted technologies to edit image material provided to us.
This may be used, for example, to:
improve the technical or visual quality of an image,
adapt or replace a background,
remove disruptive or unsuitable image elements, or
place a person in a realistic visual context that corresponds to their actual learning, vocational training or professional field.
AI-assisted editing must not create false or misleading statements about the person depicted.
In particular, it must not create inaccurate statements concerning:
identity,
qualifications,
employer,
vocational training or employment relationships,
achievements,
activities actually performed,
location, or
the actual stage of the Candidate Journey.
AI-edited content is reviewed by a person before publication.
AI-generated or substantially AI-manipulated content that may give the impression of an authentic recording or an actual event is clearly and appropriately labelled as AI-generated or AI-edited where this is required by law.
AI service providers used
Before a candidate photograph or other personal material is transferred to an external AI service provider, we inform you in the specific consent form or supplementary privacy information about the following in particular:
name and registered office of the service provider,
purpose and scope of the processing,
categories of data processed,
possible recipients,
location of processing,
any possible third-country transfer, and
the safeguards used for that transfer.
Without this specific information and the required legal basis, Candidate Journey photographs will not be transferred to an external AI service provider for AI-assisted image editing.
The legal basis for voluntary AI-assisted image editing is generally your separate consent pursuant to Article 6(1)(a) GDPR.
Tally – forms, consent and uploads
We use Tally for certain forms, consent processes, enquiries and, where applicable, the uploading of Candidate Journey materials.
The provider is:
Tally BV, Belgium
The following data may be processed through Tally in particular:
name and contact details,
form responses,
information concerning consent given or refused,
time and content of consent,
withdrawal information,
programme-specific information,
technical metadata relating to the form submission, and
where applicable, uploaded photographs or other materials.
Inside Culture Academy e.K. is the controller responsible for the data collected through our Tally forms.
Tally generally processes the form data as a processor on our behalf.
The legal basis depends on the purpose of the relevant form. This may be in particular:
Article 6(1)(a) GDPR for voluntary consent,
Article 6(1)(b) GDPR for contract or programme enquiries, or
Article 6(1)(f) GDPR for other legitimate organisational purposes.
According to Tally, form data are transmitted and stored in encrypted form and are generally stored in Europe.
We determine how long form responses are stored in our Tally account. Following deletion, according to Tally, remaining copies may continue to exist in backup systems for up to 90 days before being permanently deleted.
Depending on the Tally functions activated, additional technical subprocessors may be involved, for example for file uploads or email notifications. Where this results in a transfer to a third country, the relevant requirements of Articles 44 et seq. GDPR apply.
Newsletter and voluntary marketing communication
If you wish to receive a newsletter or other promotional information, we process the necessary contact details on the basis of your consent pursuant to Article 6(1)(a) GDPR.
Registration is voluntary and is obtained separately from other processing purposes.
You can withdraw your consent at any time with effect for the future, in particular via an unsubscribe link contained in the relevant message or by contacting:
datenschutz@inside-culture-academy.de
Following withdrawal, your data will no longer be used for the relevant marketing purpose.
We may store your email address on a suppression list where this is necessary to ensure that your withdrawal or objection is reliably respected in the future.
Student discounts and supporting documents
Where we offer special conditions or student discounts, it may be necessary to submit supporting documentation in order to verify eligibility.
The following data may be processed in particular:
name,
email address,
training or student status, and
certificate of enrolment or comparable evidence.
Processing takes place exclusively to verify eligibility and, where applicable, to prepare or perform the relevant contractual relationship.
The legal basis is Article 6(1)(b) GDPR.
Submitted certificates of enrolment or comparable evidence are generally deleted within 30 days after the assessment has been completed, unless a statutory obligation or a documented reason for longer storage exists.
The conditions of a discount are governed separately from this Privacy Policy.
Competitions and special campaigns
If you voluntarily participate in a competition or special campaign, we process the personal data required for this purpose.
These may include in particular:
name,
email address,
social media profile name,
competition entry, and
where applicable, shipping details for a prize.
Processing takes place to carry out the campaign, verify eligibility, determine and notify the winners, and deliver or otherwise process a prize.
The legal basis is generally Article 6(1)(b) GDPR.
The data are only used for newsletters or other marketing where separate consent has been given for this purpose pursuant to Article 6(1)(a) GDPR.
Data that are required exclusively for a campaign are generally deleted no later than 60 days after the campaign has ended and the prizes have been processed, unless statutory obligations prevent deletion.
The terms and conditions of participation are provided separately from this Privacy Policy.
Recipients of personal data
Personal data are only disclosed where this is necessary for the relevant purpose, contractually provided for or legally permitted.
Recipients or categories of recipients may include in particular:
IT, domain and hosting service providers,
communication and video-conferencing providers,
platform and form service providers,
payment service providers,
accounting and tax service providers,
self-employed trainers and experts,
professional cooperation partners,
institutional partners and stakeholders,
potential employers and their authorised representatives,
social media platform operators,
legal, tax or business advisers, and
authorities or public bodies where a statutory obligation applies.
Where a recipient processes personal data on our behalf, we conclude a data processing agreement pursuant to Article 28 GDPR.
Independent controllers process the data received in accordance with their own statutory obligations.
Data transfers outside the EU and the EEA
For certain service providers, social media platforms or international cooperation processes, personal data may be processed outside the European Union or the European Economic Area, or recipients located there may be given access to the data.
Such a transfer only takes place in compliance with Articles 44 et seq. GDPR.
Depending on the recipient, the following transfer mechanisms may be used in particular:
an adequacy decision of the European Commission,
the EU-U.S. Data Privacy Framework for appropriately certified US companies,
standard contractual clauses of the European Commission,
binding corporate rules, or
another legally provided exemption or safeguard.
Where required, we assess additional technical and organisational measures.
Consent to a general processing purpose does not automatically replace the required safeguards for a transfer to a third country.
International access to the Professional Portal
Access to the Professional Portal by professional partners, employers or other external organisations from a third country may constitute an international data transfer.
Such access is only established once:
a legal basis exists for the actual processing purpose,
the requirements of Articles 44 et seq. GDPR have been met,
the roles and responsibilities have been documented, and
the data subjects have been transparently informed about the intended access.
Retention period
We store personal data only for as long as necessary for the relevant purpose or as long as statutory obligations require continued storage.
The data are subsequently deleted or anonymised unless another legal basis permits further processing.
The following criteria apply in particular to individual categories of data:
Website and security data
Technical log data are only stored for as long as necessary for secure operation, error analysis and the prevention of abuse.
Contact and communication data
Contact and enquiry data are deleted once processing has been completed and there are no contractual, statutory or legitimate reasons for further storage.
Where communication is classified as a commercial or business letter, a statutory retention period of six years may apply.
Contract, accounting and tax data
Depending on the type of document, the following retention periods apply in particular:
ten years for books, inventories, opening balance sheets, annual financial statements and certain organisational documents,
eight years for accounting records, and
six years for commercial and business correspondence and other tax-relevant documents.
The periods generally begin at the end of the calendar year in which the relevant document was created or the last entry was made. Longer statutory periods may apply in individual cases.
Learning platform and community
User account, course and community data are generally stored for the duration of active participation and subsequently for as long as necessary for contract performance, certificate records, statutory obligations or the processing of possible claims.
Application and enquiry data
Data relating to a specific enquiry are stored for as long as necessary to assess and carry out the relevant process.
Longer storage in the Talent Pool only takes place on the basis of separate consent.
Talent Pool
Talent Pool data are stored until consent is withdrawn or the purpose of the Talent Pool no longer applies.
We regularly review whether continued storage is still required for the stated purpose.
Records of consent
Records of consent and withdrawal are stored for as long as necessary to demonstrate compliance with statutory accountability and evidentiary obligations and to establish, exercise or defend possible legal claims.
Professional Portal
Portal and community content is generally stored for the duration of active participation or for as long as required for the relevant portal purpose.
Following withdrawal, professional visibility is adjusted accordingly.
Candidate Journey
Unpublished Candidate Journey materials are deleted when the purpose no longer applies or the underlying consent is withdrawn, unless another legal basis permits continued storage.
Publications controlled by us are generally removed following withdrawal, unless another legal basis or statutory obligation prevents removal.
Copies or republications by third parties may continue to exist outside our sphere of influence.
Tally
Form responses are deleted when the relevant purpose no longer applies and there is no other legal basis for continued storage.
Following deletion, backup copies held by the provider may continue to exist for up to 90 days.
Student discounts
Certificates of enrolment and comparable supporting documents are generally deleted within 30 days after the eligibility assessment has been completed.
Competitions and special campaigns
Data required exclusively for a campaign are generally deleted no later than 60 days after the campaign has ended and the prizes have been processed.
Marketing data
Data used for newsletters or voluntary marketing communication are processed until you withdraw your consent or the relevant purpose no longer applies.
Withdrawal of consent
You can withdraw consent at any time with effect for the future.
Please direct your withdrawal to:
datenschutz@inside-culture-academy.de
Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
This applies in particular to consent concerning:
inclusion in the Talent Pool,
receipt of information and updates,
participation in the Professional Portal,
professional visibility in community areas,
the Candidate Journey,
use of existing information,
documentation of future milestones,
publication of photographs or interviews,
publication through specific channels, and
AI-assisted image editing.
Withdrawal of consent to the Professional Portal
Withdrawal of consent to professional visibility generally has no effect on regular learning access.
Your visibility and access to areas intended for external professional visitors will be adjusted accordingly.
Withdrawal of consent to the Candidate Journey
Following withdrawal, we stop future publications controlled by us that are based on this consent.
Published content controlled by us is generally removed unless another legal basis or legal obligation prevents removal.
We cannot guarantee that copies, screenshots, search engine archives or republications by third parties will be completely deleted.
Your data protection rights
Subject to the applicable statutory requirements, you have in particular the right to:
access pursuant to Article 15 GDPR,
rectification pursuant to Article 16 GDPR,
erasure pursuant to Article 17 GDPR,
restriction of processing pursuant to Article 18 GDPR,
data portability pursuant to Article 20 GDPR,
object pursuant to Article 21 GDPR, and
withdraw consent pursuant to Article 7(3) GDPR.
To exercise your rights, please contact:
datenschutz@inside-culture-academy.de
We may request additional information where this is necessary to confirm your identity and protect personal data against unauthorised access.
Objection to processing based on legitimate interests
Where we process personal data on the basis of Article 6(1)(f) GDPR, you have the right to object to the processing on grounds relating to your particular situation.
We will then no longer process the relevant data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or unless the processing serves to establish, exercise or defend legal claims.
Where personal data are processed for direct marketing purposes, you may object to this processing at any time.
Right to lodge a complaint with a data protection supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR.
For companies based in Bremen, the competent supervisory authority is in particular:
The State Commissioner for Data Protection and Freedom of Information of the Free Hanseatic City of Bremen
Georgstraße 122–124
27570 Bremerhaven
Germany
Telephone: +49 471 596 2010 or +49 421 361 2010
Email: office@datenschutz.bremen.de
You may also contact another data protection supervisory authority with jurisdiction pursuant to Article 77 GDPR.
Requirement to provide data
We require certain personal data in order to:
conclude contracts,
process bookings,
process payments,
create user accounts,
provide requested programmes or services, or
process a specific application or placement enquiry.
Mandatory fields are generally limited to the information required for these purposes.
Without the required information, certain services may not be offered or provided.
Voluntary information and optional consent are marked accordingly or are clear from the relevant context.
Consent to additional functions such as the Talent Pool, marketing communication, the Professional Portal, the Candidate Journey, publication of photographs or AI-assisted image editing is generally not a requirement for regular learning access.
Automated decision-making
As a general rule, we do not make decisions based solely on automated processing within the meaning of Article 22 GDPR that produce legal effects concerning you or similarly significantly affect you.
If we use such a process in the future, you will be informed separately in advance about the logic involved, the significance and the intended consequences.
Minors
Our services are generally intended for adults unless expressly stated otherwise for a specific service.
Where minors may participate in a service, we comply with the applicable statutory requirements. Where necessary, the approval or consent of a person with parental responsibility is obtained.
Minors should not submit photographs, application documents or other personal content without the involvement of a person with parental responsibility where this is legally required for the relevant process.
Data security
We implement appropriate technical and organisational measures to protect personal data against:
loss,
destruction,
unauthorised access,
unauthorised alteration,
unauthorised disclosure, and
other unlawful processing.
Depending on the relevant processing activity, these measures include in particular:
encrypted data transmission,
access restrictions,
role-based permissions,
secure user accounts,
regular system updates,
data backups,
confidentiality obligations, and
documented data protection and security processes.
Our website uses an encrypted connection for the secure transmission of data.
Changes to this Privacy Policy
We may amend this Privacy Policy if our services, technologies, service providers, processes or legal requirements change.
The current version published on our website applies. The date of the latest update can be found at the beginning of this Privacy Policy.
An amendment to this Privacy Policy does not retrospectively extend consent that has already been given.
Where a new purpose or materially changed processing activity requires new consent, we obtain this consent separately.