Data protection academy

Learn more about privacy in the context of using the Polyteia Academy.

Below we inform you in accordance with Art. 13 General Data Protection Regulation (GDPR) about the processing of your personal data in the context of using the learning platform academy.polyteia.de.

1. Data Controller

The data controller for data processing in the context of using the platform academy.polyteia.de is:

Polyteia GmbH Schlesische Straße 27 10997 Berlin Email: [email protected]

2. Data Protection Officer

Our external data protection officer is available for information on data protection matters at the following contact details:

Ali Tschakari, LL.M. Bitkom Servicegesellschaft mbH Albrechtstraße 10 10117 Berlin Email: [email protected]

Please specify when contacting that it concerns the platform academy.polyteia.de.

3. Purposes and Legal Bases of Processing

We process your personal data for the purpose of providing and using our training platform academy.polyteia.de. This includes in particular:

• setting up and managing your user account

• participation in courses, webinars or training sessions

• technical operation and security of the platform

• communication within the scope of the user relationship

• analysis and optimization of the training offering

Legal basis for processing is primarily Art. 6 Para. 1 lit. b GDPR (processing for the performance of a contract or for pre-contractual measures).

Additionally, we process data on the basis of Art. 6 Para. 1 lit. f GDPR (legitimate interest), for example for:

• abuse prevention and IT security

• development of the platform

• ensuring system availability

Legitimate interests: Our interest lies in the reliable, secure and user-friendly provision of the Data Academy.

4. Categories of Processed Data

• Registration data (name, email address, organization)

• Usage data (login data, courses visited, processing status, learning progress)

• technical connection data (IP address, browser type, timestamp, device)

• Communication data (support requests, system notifications)

5. Recipients of Data

Your data is made available internally exclusively to Polyteia employees insofar as this is necessary for contract performance. In addition, we use Articulate Global LLC (USA) as a technical service provider (data processor pursuant to Art. 28 GDPR) for the operation of the platform. Data processing is carried out exclusively on documented instructions from Polyteia.

6. Data Transfer to Third Countries

In the context of hosting and technical provision of the platform academy.polyteia.de, we use the service provider Articulate Global LLC, 244 5th Avenue, Suite 2960, New York, NY 10001, USA. This may result in the transfer of personal data to the United States of America (USA).

To secure this transfer, appropriate safeguards pursuant to Art. 46 GDPR have been implemented:

• Conclusion of Standard Contractual Clauses (SCCs) of the European Commission with Articulate

• Certification of Articulate under the EU-U.S. Data Privacy Framework (DPF) (adequacy decision recognized by the EU Commission for data transfers to the USA)

These measures ensure an adequate level of data protection in accordance with GDPR requirements.

Further information about data processing by Articulate can be found in Articulate's privacy policy at: https://www.articulate.com/trust/privacy/

The current certification under the Data Privacy Framework can be found at: https://www.dataprivacyframework.gov/

7. Storage Duration

We store your personal data:

• as long as it is necessary for the fulfillment of contractual purposes

• until deletion of your user account or the end of the training relationship

• in accordance with statutory retention periods, where applicable

We do not store technical usage data (e.g. IP addresses, log data). Technical usage data stored by the service provider Articulate can be found in Articulate's privacy policy (see above).

8. Obligation to Provide Data

The provision of personal data is required for the use of the platform. Without the provision of necessary data (e.g. email address for registration), the use of the Data Academy is not possible.

9. Your Rights as Data Subject

With regard to the data processing listed here, you have various data subject rights that are regulated in the GDPR.

9.1 Right of Access

You have the right pursuant to Art. 15 EU-GDPR to request confirmation from us as to whether personal data concerning you is being processed. If this is the case, you have a right to information about this personal data and the information mentioned in Art. 15 Para. 1 Sentence 2 EU-GDPR. This includes in particular the purpose of processing, the categories of data processed, the recipients to whom data has been or will be disclosed, where possible the planned duration of storage or the criteria for determining the duration of storage.

9.2 Right to Rectification

You have the right pursuant to Art. 16 EU-GDPR to request the immediate rectification of inaccurate personal data concerning you. Taking into account the purposes of processing, you have the right to request the completion of incomplete personal data – including by means of a supplementary statement.

9.3 Right to Erasure

You have the right pursuant to Art. 17 EU-GDPR to request that personal data concerning you be erased without undue delay. We are obliged to erase personal data without undue delay, provided that one of the grounds in Art. 17 Para. 1 EU-GDPR applies. These reasons include, for example, that the data is no longer necessary for the purposes for which it was collected or otherwise processed.

9.4 Right to Restriction of Processing

You have the right pursuant to Art. 18 EU-GDPR to request restriction of processing if one of the conditions mentioned in Art. 18 EU-GDPR is met. This includes, for example, if you contest the accuracy of the personal data. We may then only process the data in a restricted manner for as long as it takes to verify the accuracy of the personal data.

9.5 Right to Data Portability

You have the right pursuant to Art. 20 EU-GDPR to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format. You have the right to transfer this data to another controller, i.e. another entity that processes data, without hindrance, provided that the original processing was based on consent or was necessary for the performance of a contract.

9.6 Right to Object

You have the right pursuant to Art. 21 EU-GDPR to object at any time to the processing of personal data concerning you if this data is processed on the basis of Art. 6 Para. 1 lit. e) or f) EU-GDPR and there are reasons arising from your particular situation. Objection may be raised at any time against the processing of data for the purpose of direct marketing. Personal data will then no longer be processed for this purpose. The right to object can be exercised by an informal declaration. A written declaration or alternatively an email to the contact address mentioned above is sufficient.

9.7 Right to Lodge a Complaint with a Supervisory Authority

You have the right pursuant to Art. 77 EU-GDPR, without prejudice to any other administrative or judicial remedy, to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you are of the opinion that the processing of personal data concerning you infringes this Regulation. In the present case, the competent supervisory authority is:

Berlin Commissioner for Data Protection and Freedom of Information Alt-Moabit 59-61 10555 Berlin Entrance: Alt-Moabit 60 Tel.: [phone] Email: [email protected]

10. Is there automated decision-making / profiling?

No. Automated decision-making pursuant to Art. 22 GDPR or profiling does not take place in the context of using the platform.

11. Final Provisions

Polyteia GmbH reserves the right to adapt this privacy policy at any time so that it always complies with current legal requirements or to implement changes to services in the privacy policy, e.g. when introducing new services. The new privacy policy will then apply to renewed access to this website.

As of: July 2025