Privacy policy of the SKHM portal

1. Controller and contact

The controller for data processing in the portal is the operator of the Studienkolleg Halle-Merseburg (SKHM):

Ming CHENG Institut GmbH, An der Magistrale 120, 06124 Halle (Saale), Germany. Managing director: Ming CHENG.

For all questions about data protection and to exercise your rights, please write to datenschutz@studienkolleg-halle.de or by post to the address above, marked “Datenschutz”.

2. Who this policy concerns

The portal is used by:

• applicants for a course at the SKHM,
• students and graduates of the SKHM,
• partners: referrers (private persons with a referral code) and agencies,
• staff and teachers of the SKHM.

3. Visiting the portal, security

When you open any page, our hosting provider Cloudflare (section 10) processes technically necessary connection data: IP address, time, requested address, browser and device type. This data is needed to deliver the page, to fend off attacks and to find errors. Error and process logs of the portal are kept at Cloudflare for a short time (usually a few days) and then deleted automatically.

To prevent abuse (e.g. mass login attempts) we limit the number of certain actions. For this we do not store your IP address, only a check value (hash) calculated from it, together with the time. These entries are deleted after 24 hours at the latest.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and undisturbed operation of the portal.

4. Cookies and local storage

We do not use cookies for advertising, analytics or tracking and do not embed external fonts, maps, videos or analytics tools. Only the following technically necessary items are stored on your device:

• “skhm_session”: keeps you logged in after login. Valid for at most 12 hours, deleted when you log out.
• “skhm_ref”: only set when you arrive via a partner's referral link. It remembers the partner's code so that your application can be assigned to that partner. Valid for 60 days, deleted on registration.
• Local storage of your browser: remembers whether you closed the notice about the next course start. It contains no personal data and is not sent to us.

The legal basis for storing on your device is Section 25(2) no. 2 TDDDG, as the storage is strictly necessary for the service you requested. The subsequent processing is based on Art. 6(1)(b) GDPR (login) or Art. 6(1)(f) GDPR (assignment to a partner).

5. Account and login

For an account we process your name, e-mail address, communication language and password. We do not store the password in plain text, only as a non-reversible check value (PBKDF2 with an individual salt). You confirm your e-mail address with a code that we send you by e-mail.

Students can alternatively log in with their matriculation number and the password of the SKHM learning platform Stud.IP. The portal then forwards the input in encrypted form to the SKHM's Stud.IP server and only receives the answer whether the login is valid. The Stud.IP password is not stored in the portal. The Stud.IP server is operated on behalf of the SKHM by STRATO GmbH in Germany.

The legal basis is Art. 6(1)(b) GDPR (use of the portal).

6. Application

For your application we process:

• the desired course and semester,
• personal details as in your passport: name, sex, date and place of birth, country of birth, nationality, passport number,
• contact details: e-mail, phone, address,
• information on financing; if an organisation (e.g. a scholarship provider or employer) pays the costs, also its name, contact person, e-mail and address,
• school education, university entrance qualification, intended studies and language skills,
• uploaded documents: passport, photo, school certificate, transcript, APS certificate, translations, language certificate, CV, confirmation of cost coverage and other evidence,
• the declaration of truth you made (wording, version, language, time),
• the course of the procedure: status, admission check, entrance examination, requests for missing items, messages between you and the student office, fees and payment status.

The purpose is to carry out the application and admission procedure: checking the requirements, entrance examination, admission and course contract, and issuing notices and certificates.

The legal bases are Art. 6(1)(b) GDPR (preparing and concluding the course contract) and Art. 6(1)(c) GDPR where legal obligations apply. Confirming the privacy notice on registration means that you have taken note of it. We do not base the processing of your application on consent.

We need the details marked as required in the form and the required documents to be able to assess your application. Without them, an application is not possible.

If an agency creates your application for you, we receive your data from that agency. The agency has confirmed to us that you agreed to the transfer and received this notice.

Admission decisions are made by SKHM staff. There is no solely automated decision within the meaning of Art. 22 GDPR.

7. Studies

After enrolment we process in your student file: matriculation number, master data from the application, course, group, study status, timetable, grades and exam results including the Feststellungsprüfung, attendance and certificates issued. Teachers only see the data of their groups as far as they need it for teaching and assessment.

The legal basis is Art. 6(1)(b) GDPR (course contract). For conducting the state Feststellungsprüfung (university entrance qualification examination) and issuing its certificate, the legal basis is Art. 6(1)(e) GDPR, as the SKHM performs a sovereign (public) task in doing so.

Sick notes for exams: if you cannot take part in an exam because of illness, you can upload a reason and a medical certificate. These documents may contain health data (Art. 9 GDPR). We use them only to decide on your withdrawal from the exam. Please do not state a diagnosis; a certificate of unfitness for the exam is sufficient. Submitting is voluntary; the legal basis is your explicit consent under Art. 9(2)(a) GDPR, given by submitting. You can withdraw it for the future; the withdrawal from the exam can then no longer be based on the certificate.

8. Partners: referrers and agencies

When you register as a partner we process your name and contact details, for agencies also company details and verification documents, and the acceptance of the partner terms. To pay commissions to referrers we process account holder, IBAN, address and tax details; these are only requested before the first payout. Every payout is documented.

We count clicks on referral links only as a daily total per partner, without any data of the person who clicked.

Partners see applications of persons who registered themselves via their link or code only in a very limited form (initials, course, status). Agencies see and edit in full only the applications they created themselves.

The legal bases are Art. 6(1)(b) GDPR (partner contract) and Art. 6(1)(c) GDPR (retention duties under commercial and tax law). For assigning an application to a partner we rely on Art. 6(1)(f) GDPR; our legitimate interest is the correct settlement of commissions.

9. Payments

Fees can be paid by bank transfer or, where offered, online. For online payment you are forwarded to the payment provider Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). We transmit the amount, the payment reference (application number) and your e-mail address. You enter your card or account details directly at Stripe; we do not receive them, only the confirmation whether the payment was successful.

Stripe may also transfer data to Stripe, Inc. in the USA. Stripe, Inc. is certified under the EU-US Data Privacy Framework; in addition the EU Commission's standard contractual clauses apply. For the payment processing Stripe is partly a controller in its own right; Stripe's privacy policy then applies (stripe.com/privacy).

The legal bases are Art. 6(1)(b) GDPR (payment) and Art. 6(1)(c) GDPR (accounting duties). If you do not want to pay online, you can pay by bank transfer.

10. Service providers (processors)

We use the following service providers, which process data only on our instructions and with which data processing agreements under Art. 28 GDPR are in place:

• Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA – hosting of the portal. Database and documents (e.g. passport and certificates) are stored exclusively in data centres in the EU (Cloudflare jurisdiction “EU”). Delivering pages and processing individual requests may take place in data centres outside the EU. Cloudflare is certified under the EU-US Data Privacy Framework; in addition standard contractual clauses apply.
• Brevo (Sendinblue SAS), 106 boulevard Haussmann, 75008 Paris, France – sending e-mails from the portal (confirmation codes, status notifications, notices of new messages). Name, e-mail address and the content of the e-mail are transmitted. For data protection reasons these e-mails contain no details about your documents, only a notice to check the portal.
• IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany – domain and e-mail mailboxes of the SKHM. E-mails you write to us directly are received there.
• STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany – server of the learning platform Stud.IP (see section 5).

11. Other recipients

Within the SKHM only staff who need access for their tasks receive it; rights are separated by area. Beyond that we only pass on data

• to the agency or partner through whom you applied, to the extent described in section 8,
• to the organisation that, according to your information, pays the costs, as far as fees are concerned,
• to public authorities where we are legally obliged to,
• to other bodies (e.g. for a visa or a university application) only if you initiate it or consent.

Many agencies are based outside the EU. An agency that created your application already knows your data; from us it additionally receives information on the status of your procedure. The legal basis for this is Art. 49(1)(b) GDPR, as you yourself engaged the agency for your application.

12. Storage period

We store personal data only as long as necessary for the respective purpose or as required by statutory retention duties. In detail:

• Login cookie: at most 12 hours; referral cookie: 60 days; abuse protection: 24 hours.
• Applications that do not lead to studies (rejection, withdrawal, procedure ended): until the end of the periods in which the decision can be challenged, and as long as a new application in the current application period is possible.
• Student data: for the duration of the studies. Data needed to prove completion and exam results (e.g. grades, certificates, Feststellungsprüfung) are kept longer so that we can issue duplicates and confirmations later.
• Invoice, payment and payout data: according to the retention periods under commercial and tax law (up to 10 years).
• Sick notes for exams: until the exams of the semester are completed and no legal remedies are possible any more.

Automatic deletion after fixed periods is currently being set up in the portal. Until then we delete data manually according to the criteria above and at any time on your request, unless a retention duty prevents this.

13. Your rights

You have the right to:

• access to your stored data (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on Art. 6(1)(e) or (f) GDPR on grounds relating to your particular situation (Art. 21 GDPR),
• withdraw consent given, with effect for the future (Art. 7(3) GDPR).

Please contact datenschutz@studienkolleg-halle.de.

You also have the right to lodge a complaint with a data protection supervisory authority. Responsible for us is: Landesbeauftragte für den Datenschutz Sachsen-Anhalt, Otto-von-Guericke-Straße 34a, 39104 Magdeburg, Germany (Postfach 1947, 39009 Magdeburg), datenschutz.sachsen-anhalt.de.

14. Security

The connection to the portal is always encrypted (HTTPS). Documents are not publicly accessible and are only delivered after checking access rights. Passwords are only stored as a check value. Staff only have access to the areas they need for their tasks.

15. Changes

We adapt this privacy policy when the portal, the services used or the legal situation change. The version published here applies.