Privacy Policy

Introduction

As the operator of this website, we, the Bertelsmann Stiftung, are responsible for processing the personal data of those using it. Our contact details can be found in the website’s “imprint.” The contact persons for questions regarding the processing of personal data are named directly in this privacy policy.

We at the Bertelsmann Stiftung take the protection of your privacy and your personal data very seriously. We collect, store and use your personal data only in accordance with the content of this privacy policy and the applicable data protection regulations, in particular the European General Data Protection Regulation (GDPR) and national data protection regulations.

With this privacy policy, we want to inform you of the extent to which we process personal data when our website is used and the purposes for which we process that data.

Personal data

Personal data is information about an identified or identifiable natural person. This includes all information relating to your identity, such as your name, email address or postal address. Information that cannot be linked to your identity (such as statistical data, e.g. the number of people using the website) is not considered personal information.

You can generally use our website without disclosing your identity and without providing personal data. In this case, we will only collect general information about your visit to our website. However, for some of the services we offer, we will collect personal data from you. We will only process this data for purposes related to using these services, in particular to provide any requested information. When collecting personal data, only data that is absolutely necessary must be provided. Additional information may also be provided, but this is voluntary. We indicate which information is mandatory and which is optional. Specific details are given in the relevant section of this privacy policy.

When you use our website, no automated decision-making takes place based on your personal data.

Processing personal information

Your data is stored by us on specially protected servers within the European Union. The servers are protected by technical and organizational measures against loss, destruction, access, modification and distribution of your data by unauthorized persons. Access to your data is only possible for a few authorized persons. These persons are responsible for the technical, commercial and editorial support of the servers. Despite regular checks, however, it is not feasible to provide complete protection against all possible dangers.

Your personal data is encrypted when transmitted over the Internet. We use TLS encryption (Transport Layer Security) for data transmission.

Disclosure of personal data to third parties

We only use your personal information to provide the services you have requested. If we use external service providers to provide these services, they only have access to the data for the purpose of providing the relevant services. We use technical and organizational measures to ensure compliance with data protection regulations and we require our external service providers to do the same.

Furthermore, we will not disclose your data to third parties without your express consent, especially not for advertising purposes. Your personal data will only be disclosed if you have consented to the disclosure of the data or if we are entitled or obliged to do so on the basis of legal provisions and/or official or court orders. This may include the provision of information for the purposes of criminal prosecution, averting danger or enforcing intellectual property rights.

If we transfer your personal data ourselves or through service providers to countries outside the European Union, we comply with the specific requirements of Art. 44 ff. GDPR and we require our service providers to comply with these regulations. We will therefore only transfer your data to countries outside the European Union in keeping with the level of protection guaranteed by the GDPR. This level of protection is ensured in particular by an adequacy decision of the EU Commission or by appropriate safeguards in accordance with Art. 46 GDPR.

Legal basis for data processing

Insofar as we obtain consent for the processing of your personal data, Art. 6 (1) (a) GDPR serves as the legal basis for data processing.

If we process your personal data because this is necessary for the performance of a contract or in the context of a quasi-contractual relationship with you, Art. 6 (1) (b) GDPR serves as the legal basis for data processing.

When we process your personal data to fulfill a legal obligation, Art. 6 (1) (c) GDPR serves as the legal basis for data processing.

Article 6 (1) (f) GDPR also serves as a legal basis for data processing if the processing of your personal data is necessary to safeguard a legitimate interest of our foundation or of a third party, and your interests, basic rights and freedoms do not require the protection of personal data.

In this privacy policy, we always indicate the legal basis that we use for the processing of your personal data.

Data deletion and storage period

We always delete or block your personal data when the reason for which it must be stored no longer applies. However, storage may continue if this is required by legal provisions to which we are subject, for example with regard to statutory retention and documentation obligations. In such a case, we will delete or block your personal data once the corresponding requirements no longer apply.

Using our website

Information about your computer

Every time you access our website, we automatically collect information that your browser transmits to our server, regardless of whether you are registered. This includes:

the IP address or host name of the accessing computer,
the date and time of the server request, including the time zone difference to Greenwich Mean Time (GMT),
the specific page or content of the request,
the access status (HTTP status code) and the amount of data transferred,
the referrer URL (the previously visited page),
information about the browser software used (language and version),
the operating system used and its interface.

This data is needed for technical reasons to ensure the stability and security of our website. The IP address is only stored for a period of up to seven days and is then deleted or anonymized by truncation. The other listed data is only stored for a limited period of time.

We use this data to operate our website, in particular to detect and eliminate errors, to determine the extent of the site’s utilization and to make adjustments or improvements. These purposes also constitute our legitimate interest in data processing pursuant to Art. 6 (1) (f) GDPR.

Use of cookies

Like many others, our website uses cookies. Cookies are small text files that are stored on your computer and save certain settings and data for exchange with our website via your browser. A cookie usually contains the name of the domain from which the cookie file was sent, information about the age of the cookie and an alphanumeric identifier.

Cookies enable us to recognize your computer and make any pre-settings and preferences immediately available. The cookies we use are, as far as possible, so-called session cookies, which are automatically deleted at the end of the browser session. In some cases, cookies with a longer storage period may also be used so that your pre-settings and preferences can be taken into account the next time you visit our website.

Most browsers are set to accept cookies automatically. However, you can deactivate the storage of cookies or set your browser to notify you as soon as cookies are sent. It is also possible to manually delete cookies that have already been stored via your browser settings. Please note that you may only be able to use our website and online services to a limited extent or not at all if you refuse to accept cookies or delete necessary cookies.

If cookies are not necessary for accessing our website, we will ask for your consent to use them when you first visit the website. With regard to non-essential third-party cookies, you will find a more detailed description of the third-party services we use below. The legal basis for the associated data processing, including any data transfer, is your consent in keeping with Art. 6 (1) (a) GDPR. Once given, consent can be revoked at any time with effect for the future, in particular by changing the selected settings.

The legal basis for the use of necessary cookies is our legitimate interest in the proper provision of our online services in keeping with Art. 6 (1) (f) GDPR and – insofar as contracts are concluded or fulfilled via our website – the fulfillment of the contract in keeping with Art. 6 (1) (b) GDPR.

Use of third-party services

We use third-party services for some of our website’s features. These services are predominantly optional functions that you must explicitly select or explicitly use. We have contractual agreements with the respective parties for the provision and use of their services and, to the extent possible, we try to ensure that third-party suppliers also provide transparent information about the scope of the processing of personal data and that they comply with data protection regulations.

etracker

We use the analytic services of etracker GmbH, Erste Brunnenstraße 1, 20459 Hamburg, Germany, for our website. etracker’s technologies make it possible to analyze your user behavior. We have chosen etracker’s no-cookie option, meaning cookies are not used in the online process. With the help of etracker’s technologies, we collect and store the following data:

Frequency of page views
Search terms
Use of website functions
Truncated IP address
Date and time of the request
Access status/HTTP status code
Amount of data transferred
Website from which the request originates
Browser
Operating system and its interface
Language and version of the browser software

When user data is retained, IP addresses and data on visitors’ devices and domains are also stored, but only in truncated form or encrypted so that it is not possible to identify individual users. The data collected is never merged with other data sets, e.g. to identify individual users.

The IP address is shortened automatically and at the earliest possible point in time, without you as a user having to make any special changes or adjustments.

We use etracker to improve and optimize the quality of our website and its content, as well as to check and improve the reach and findability of our online offerings. These purposes also constitute our legitimate interest in keeping with the legal basis for data processing pursuant to Art. 6 (1) (f) GDPR.

Further information on etracker’s data protection policy can be found here: https://www.etracker.com/en/data-protection-by-etracker/ 

Communicating with us

You can contact us in various ways, including via the contact details on our website. We are also happy to provide you with regular information on various topics by emailing you one or more of our newsletters.

When you subscribe to our newsletter, your email address will be used by the Bertelsmann Stiftung for informational purposes until you unsubscribe. You will receive regular emails about current topics addressed by our projects as well as special emails, such as those related to new studies and events. The emails may be personalized and customized based on the information you have provided us about you.

Unless you have consented in writing, we use the double opt-in procedure to register for our newsletter, i.e. we will only send you a newsletter by email if you have expressly confirmed to us beforehand that you want the newsletter dispatched. We will then send you a notification email and ask you to confirm that you wish to receive our newsletter by clicking on a link contained in the email.

In addition, you can sign up for our newsletters by scanning a QR code provided on-site at events. When you scan the QR code, a pre-formatted email to us will open in the email program installed on your device. This email will only be dispatched if you actively send it. In this case, we process your email address, the content of your consent statement, the date and time of receipt, and the technical delivery information of the email for the purpose of documenting your consent and sending the newsletter.

If you have registered to receive the newsletter, we will record and analyze when you open or click on content. We receive information about the extent to which the newsletters or links sent are opened and used, whether emails have been rejected and whether customers receive an email and then unsubscribe from the newsletter. The recorded information is used to personalize and customize the newsletter, e.g. based on the data or preferences provided. It is not possible to subscribe to the newsletter without having the relevant information recorded. If you do not want information to be recorded, you can unsubscribe from the newsletter altogether.

If you have expressly subscribed to the newsletter, the legal basis for processing your data is your consent pursuant to Art. 6 (1) (a) GDPR. In keeping with the legal requirements, you also might receive our newsletter without giving your express consent because you ordered publications from us, we thus received your email address and you did not object to being emailed information. In this case, the legal basis is our legitimate interest in sending direct marketing in accordance with Art. 6 (1) (f) GDPR.

If you no longer wish to receive newsletters from us, you can revoke your prior consent at any time with effect for the future or can inform us you do not want to receive further newsletters. No costs ensue other than transmission costs at basic rates. Simply use the unsubscribe link included in every newsletter or send a message to us or our data protection officer.

Social media

Our website contains links or plugins to the social networks LinkedIn and Bluesky. You can recognize the links by the respective provider’s logo.

Clicking on the links will open the corresponding social media pages, to which this privacy policy does not apply. For details on the provisions applicable there, please refer to the respective privacy policies of the individual providers. You can find them at:

LinkedIn: https://www.linkedin.com/legal/privacy-policy 

Bluesky: https://bsky.social/about/support/privacy-policy 

No personal information is transmitted to the respective providers before you click on the corresponding links or plugins. Your visit to the linked site is also the basis for data processing by the relevant provider.

We would also like to point out here that Germany’s Federal Office for Information Security (BSI) provides general information on the safe use of social networks on its website at https://www.bsi.bund.de/EN/Themen/Verbraucherinnen-und-Verbraucher/Informationen-und-Empfehlungen/Onlinekommunikation/Soziale-Netzwerke/soziale-netzwerke_node.html.

The following information regarding the processing of your personal data also applies to our use of social media channels.

Bluesky

We also operate an account on the Bluesky social network. We use our Bluesky account to provide information about our activities and offer a channel for communication. The platform is operated by Bluesky PBLLC, Seattle, Washington.

Please note that use of Bluesky and its features is at your own risk, especially with regard to interactive features such as commenting, sharing or rating.

Processing personal data

When you visit our Bluesky profile, personal data is processed by the platform operator and may be transferred to countries outside the European Union. The type, scope, and purposes of this data processing are largely determined by Bluesky’s privacy policy. When you access our Bluesky content, Bluesky processes a range of data, including your IP address and other information that may be stored in the form of cookies on the device you are using or in the respective browser. We have no influence on the data processing carried out by Bluesky. Further information on data processing by Bluesky can be found in Bluesky’s privacy policy, available at https://bsky.social/about/support/privacy-policy#data-use. 

We process the data you provide to Bluesky, in particular your username and the content published via your account, insofar as we repost your posts, respond to them or publish posts ourselves that refer to your account. The data you freely publish and distribute on Bluesky is included in our offering in this way and made available to our followers in order to make our channel more attractive.

Bluesky allows you to configure additional privacy settings for your account. For more information, please visit: 
https://bsky.social/about/support/privacy-policy#privacy-choices.

Bluesky Direct Messaging

At Bluesky, you can communicate with us directly using Bluesky Direct Messaging. If you contact us using Bluesky Direct Messaging, we will store and use the transmitted data exclusively for the purpose of responding to your inquiry. The legal basis for the processing of your data is your consent in accordance with Art. 6 (1) (a) GDPR and our legitimate interest in accordance with Art. 6 (1) (f) GDPR. Our legitimate interest lies in the collection and processing of customer inquiries, the evaluation of those inquiries and the prevention of misuse.

The data is deleted as soon as it is no longer required for the purpose for which it was collected. For your personal data, this is the case when the respective conversation has ended. For us, the conversation is ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified. You have the option of revoking your consent to the processing of your personal data at any time; in this case, we will delete the data immediately if there is no basis for further storage.

Additional information about Bluesky

If you have any questions about our use of personal data in connection with our Bluesky account, please feel free to contact us and our data protection officer at any time. The contact details and communication channels are explained in our privacy policy. If you have any questions about data protection at Bluesky, please contact Bluesky directly.

LinkedIn Account

In addition to our own website, we also operate an account on the LinkedIn career network. We use this account to provide information about our organization and our activities and to offer a channel for communication. The LinkedIn career network is operated by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (hereinafter: “LinkedIn”).

Please note that use of LinkedIn and its functions is at your own risk. This applies in particular to the use of interactive functions (e.g., liking, sharing, commenting).

Processing personal data

The data collected about you when you use its services is processed by LinkedIn. It cannot be ruled out that data may also be transferred to countries outside the European Union. The data processed includes the data you voluntarily provide, such as your name, username, email address, telephone number; information about your professional career; profile data; content you create, upload or receive; as well as comments, your IP address, information about the device you use; information about websites and content you visit; and your location. We have no influence on the type and scope of data processed by LinkedIn, the type of processing and use, or the transfer of this data to third parties. Information about what data is processed by LinkedIn and for what purposes can be found in LinkedIn’s privacy policy at https://de.linkedin.com/legal/privacy-policy.

We process the data you enter on LinkedIn to the extent that we may like, comment on or share your posts, or contact and interact with you. The data you freely publish and distribute on LinkedIn is included in our offering in this manner.

You can restrict the processing of your data in the general settings of your LinkedIn account. In addition, on mobile devices, you can restrict LinkedIn’s access to contact and calendar data, photos, location data, etc. in the settings options. However, this depends on the operating system used. You can find out more about LinkedIn's privacy settings at: https://de.linkedin.com/legal/privacy-policy.

Analysis

LinkedIn offers LinkedIn account operators the opportunity to obtain an overview of the account’s use and users. The analysis functions can be used to call up and evaluate primarily statistical data. We use the data to make our account as attractive and efficient as possible. For this purpose, LinkedIn provides us with data that LinkedIn has generated on its own. The data we receive from LinkedIn is mostly anonymized data and statistics. Insofar as we receive personal data in this context, we are the ones responsible for any further processing of it we undertake to evaluate the use of our LinkedIn account. Further information can be found in LinkedIn’s privacy policy at https://de.linkedin.com/legal/privacy-policy.

Communication

LinkedIn gives you the opportunity to communicate with us directly. If you contact us via LinkedIn, we will store and use the data you provide exclusively for the purpose of responding to your inquiry. The legal basis for the processing of your data is your consent in accordance with Art. 6 (1) (a) GDPR and our legitimate interest in accordance with Art. 6 (1) (f) GDPR. Our legitimate interest lies in the collection and processing of inquiries, the evaluation of those inquiries and the prevention of misuse.

Additional information about LinkedIn

If you have any questions about our use of personal data in connection with our LinkedIn account, please feel free to contact us and our data protection officer at any time. The contact details and communication channels are explained in our privacy policy. If you have any questions about data protection at LinkedIn, please contact LinkedIn directly.

Your rights – Contacting us

At the Bertelsmann Stiftung, it is very important to us that we explain as transparently as possible how we process your data and what your rights are in this regard. If you would like more information or wish to exercise your rights, please contact us at any time so that we can address your concerns.

Rights of data subjects

You have wide-ranging rights when it comes to the processing of your personal data. First, you have a comprehensive right to receive information and, if necessary, you can request the correction, deletion or blocking of your data. You can also request that your data be processed in a more limited way, and you have a right of objection. In terms of the personal data you have provided us, you also have a right to data portability.

If you wish to exercise any of your rights and/or receive further information about them, please contact us using the contact form. Alternatively, you can contact our data protection officer.

Revoking consent, right of objection

Once you have given your consent, you can revoke it at any time with effect for the future. Revoking your consent does not affect the legality of the processing carried out on the basis of your consent until revocation. The contact persons for revoking consent are also our team members via the contact form and our data protection officer.

If the processing of your personal data is not based on consent but on another legal basis, you may object to this data processing. Your objection will lead to a review and, if necessary, termination of the data processing. You will be informed of the outcome of the review and, if the data processing is to continue, you will receive further information from us as to why the data processing is permissible.

Data protection officer and contact details

We have appointed an external data protection officer who supports us in data protection matters and whom you can also contact directly. If you have any questions regarding our handling of personal data or would like further information on data protection issues, please do not hesitate to contact our data protection officer and his team:

RA Dr. Sebastian Meyer, LL.M.
c/o BRANDI Rechtsanwälte
Adenauerplatz 1
33602 Bielefeld
Germany
Telephone: +49 521 96535-812
E-mail: datenschutz@bertelsmann-stiftung.de

If you would like to contact our data protection officer personally by email, you can also reach him at sebastian.meyer@brandi.net

Complaints

If you believe that our processing of your personal data is not in accordance with this privacy policy or applicable data protection regulations, you can lodge a complaint with our data protection officer. The data protection officer will then investigate the matter and inform you of the outcome of the investigation. You also have the right to lodge a complaint with a supervisory authority.

Additional information and changes

Links to other websites

Our website may contain links to other websites. These links are usually marked as such. We have no influence on the extent to which the applicable data protection regulations are upheld on the linked websites. We therefore recommend that you inform yourself about the data protection policies used by the relevant websites.

Changes to this privacy policy

The status of this privacy policy is indicated by the date (below). We reserve the right to change this privacy policy at any time with future effect. Changes will be made in particular in the event of technical adjustments to our website or changes to data protection regulations. The current version of the privacy policy is always available directly via our website. We recommend that you revisit this privacy policy at regular intervals to learn of any changes.

This is a translation of the German privacy policy, which is solely legally binding.

Last updated: January 2026