Source: https://kiron.ngo/privacy/
Timestamp: 2019-04-23 10:55:19+00:00

Document:
Data privacy is an important topic for us and we hold the protection of your personal data in very high esteem. We comply with the provisions of the German Federal Data Protection Act and the German Telemedia Act as well as with the EU General Data Protection Regulation.
The right to request information about your personal data processed by us pursuant to Art. 15 EU GDPR. In particular, you can request information on the purpose of processing, the category of personal data being processed, the categories of recipients to whom your data has been disclosed, the planned retention period, the right to rectification or erasure of personal data, or restriction of processing of your data, the right to lodge a complaint, what the source of the data is, if it wasn’t collected by us, and if any automated decision-making, including profiling exists and, where appropriate, meaningful information about their details.
The right, in accordance with Art. 16 EU GDPR, to demand the correction of incorrect or completion of incomplete personal data stored by us without delay.
The right to demand the deletion of your personal data stored with us, according to Art. 17 EU GDPR, as far as the processing is not required for the right of freedom of expression and information, the compliance with a legal obligation, for reasons of public interest or for the assertion, exercise or defence of legal claims.
The right, in accordance with Art. 20 GDPR, to receive your personal data provided to us in a structured, common and machine-readable format or to request the transfer to another responsible person.
The right to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR. As a rule, you can contact the supervisory authority of the federal state of our above named seat or, if applicable, your usual place of residence or work place.
If your personal data is processed by us on the basis of legitimate interests pursuant to Art. 6 para. 1 s. 1 lit. f EU GDPR, you have the right to object to the processing of your personal data in accordance with Art. 21 EU GDPR, insofar as this is for reasons that arise from your particular situation. If you object to the processing of personal data for the purpose of direct marketing, you have a general right of objection without the requirement of specifying a particular situation.
Here is an overview of the different services at Kiron where personal data may be processed. Depending on your use of the our services different sets of data may be stored, as is described in detail below.
Information you have enter in form fields on our website.
For technical and security reasons, especially the prevention of attacks on our web servers, we store this information for a short period of time. These logs are deleted after 7 days or will be anonymized so that no attribution to any specific persons is possible. We do not use this information in any way for statistical analysis and do not link this information with any other data sources.
We use Google Analytics, including the functionalities of Universal Analytics, a web analytics service provided by Google, Inc. (“Google”). Universal Analytics allows us to track usage on several devices (such as computer, tablet, smartphone). This is done by automatically assigning a pseudonym user-ID of the user. No personal identifiable information is passed to Google. Google Analytics also uses the cookies (detailed below), which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of the website will be transmitted to and stored by Google on servers in the United States. IP anonymization is activated on this website: your IP address will be truncated within the area of Member States of the European Union or other parties to the Agreement on the European Economic Area. Only in exceptional cases will the whole IP address be first transferred to a Google server in the USA and truncated there. The IP anonymization is activated on these websites.
Google will use this information on behalf of Kiron for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to Kiron. All such reports will be deleted after 14 months.
Google Inc. is a company based in the United States of America and is certified through the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks, which ensures compliance with EU data protection standards. This information helps us to improve our services and improve the experience you have on our websites which constitutes legitimate interests in accordance with Art. 6 para. 1 lit. f EU GDPR resp. art. 15 par. 3 German TMG.
As an alternative to the browser add-on or for browsers on mobile devices, you can click this link in order to opt-out from being tracked by Google Analytics on this website in the future (the opt-out applies only for the browser in which you set it and for web pages under this domain). An opt-out cookie will be stored on your device, which means that you’ll have to click this link again, if you delete your cookies.
Google Maps, Google Fonts and Youtube Videos provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. When you load our websites the necessary Google provided files will be loaded by your web browser into the browser’s cache in order to display the content correctly. The use of these embedded tools results in a server call, generally one of Google’s servers in the USA. By this the server will be informed which page you have opened and what the IP address of the browser of your device is.
We are using Google Maps and Google Fonts and Youtube videos to optimize your experience on our websites and to improve their usability. This constitutes legitimate interests in accordance with Art. 6 para. 1 lit. f EU GDPR.
If any of the cookies which are implemented on our websites process personal information, then only for the purpose of improving the usability of the websites and within our legitimate interest in accordance with Art. 6 para. 1 lit. f EU GDPR.
You are giving your consent to processing your email address for the purpose of sending a Newsletter with information about Kiron. We make use of a Double-Opt-In process which means you will receive an email after sign-up on our website and have to actively confirm your subscription. By this confirmation you consent that we may use your information in accordance with Art. 6 para. 1(f) EU GDPR to send you informational emails or updates regarding our services. Our email software may automatically track if an email has been opened.
Mailjet SAS, 13-13 bis, rue de l’Aubrac – 75012 Paris, France.
Should you be interested in applying and registering to become a Kiron Student, you agree that the information you give us will be used for the purpose of helping you succeed with your online studies with Kiron, provide you with the services suiting to your situation and needs and to potentially support you in transferring to a university. We will explain here which information we collect and for what purpose.
In order to register as a Kiron Student, you must successfully apply first.
To ensure that you are eligible for our free service, by providing some proof of your status as a “refugee”, as an internally displaced person or as a qualifying member of a host community in focus countries.
To help identify the specific Student Services which will be offered to you upon successful registration.
We collect this data to optimize our services and guidance for you, f.e. information on specialized programs for female students (“gender”), guidance in applying to universities (“country”, questions related to former school degrees and to former university attendance) and additional student services (see below). Furthermore, we use the data for scientific purposes (“date of birth”, “nationality”, “how you heard about Kiron” and motivational questions; see below).
Kiron’s student services are targeted primarily at refugees in our focus countries. In addition, we accept internally displaced people and eligible members of host communities in Jordan and Lebanon. We must therefore assess your eligibility.
The respective documents uploaded by you are stored separately from your account information.
Once successfully registering at Kiron, you will have to complete a series of steps, collectively called “Onboarding”, in order to gain access to certain Student Services. Non-completion of these steps may lead to a deactivation or blocking of your account.
When your application is successful you will be provided an email account with an address having two letters, representing the first initial of your first and last names, and a number. For instance, the name “your name” could be used to assign an email address such as “yn123@student.kiron.ngo”. This account will be maintained by Google Inc., and administered by us as part of their Google-for-Nonprofits programme.
Google Inc. is a company based in the United States of America and is certified through the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks, which ensures compliance with EU data protection standards.
Effectively, the account entails a number of functions, which are part of the G Suite. A core functionality, besides Email, is the use of the login-mechanism, i.e. you will need to login via this account, when wanting to access our services.
Kiron aims at providing an overview and specific recommendations for free online courses (Massively Open Online Courses, MOOCs), which fit your interests. Such recommendations may be selected by taking into account data Kiron has collected about you.
Kiron will allow you to get access to different free online courses, which are governed by their own separate privacy policies and terms of services. You can find a complete list of third party MOOC-Partners and their Privacy Policies and Terms of Services here.
Usually access to these services is granted via your Google G Suite login with your xyz@students.kiron.ngo account. You should login to the MOOC partners websites with your Kiron students account in order to come in favor of full functionality of these sites.
Furthermore, Kiron may receive information about the users and their activities (e.g. participation and completion of courses and programs) on and off the service from third-party partners, such as information from a MOOC-partners on the choice of subject, study record, period of study, results of completion. The processing of this information is necessary for the purposes of the legitimate interests in accordance with art. 6 para. 1 lit. f EU GDPR.
Kiron may send you updated information via email or other messaging services for which the respective contact details are used.
WhatsApp: for certain services we may also ask you to communicate through WhatsApp Messenger service (https://www.whatsapp.com/legal/#privacy-policy). You will be asked for your specific consent to communicate via WhatsApp.
Kiron also creates an account for you for our internal discussion forum based on the Discourse platform. This forum is meant to exchange your experience with other students or with members of the team at Kiron and the forums moderators may remove content at the discretion of Kiron and in regard with the forums code of conduct which can be found under https://forum.kiron.ngo/faq (once logged in).
Using the forum is optional, but you need to be aware that content you provide within the forum may be accessed by a larger audience. The forum is not accessible by external search engines, such as Google or Bing. The forum is only accessible via login with an email address granted by Kiron.
Kiron will provide specific offers based on the country or city you are currently located in. Kiron needs to know in which country you are currently located in order to offer these services. Additionally, you may provide your current city in order to further allow for tailoring of services.
We make use of the Google Location API when you enter your location on our website to be able to serve you better based on your location and in accordance with Art. 6 para. 1(f) EU GDPR.
Kiron periodically organizes events for its students and may collect specific information to facilitate the organization of such events. The participation in such events is optional and the information provided by you is used only for the organization of the specific event. Kiron may keep a record of which students participated at student events.
Kiron offers (optional) language courses and works with partners to provide you with language learning opportunities. Language partners may ask you for personal information on their website and Kiron may receive and store some info about your participation, about your language test results, etc. from the partners.
For connecting you as a students to partner universities, we may ask for your approval to communicate with universities using your name and application number.
With your consent we may help you submit your application at a university and therefore transfer your personal information to the university. We will not disclose any information which you have not given explicit permission.
Online mentoring is provided in partnership with Volunteer Vision (https://www.volunteer-vision.com). You will create a separate user account on the partners website. If you signed up to this service through your membership at Kiron, these partners may share basic data about your participation in their programs (i.e. if you attended the program or not) with Kiron.
Online mentoring is provided in partnership with IPSO (https://ipsocontext.org). You will create a separate user account on the partners website. If you signed up to this service through your membership at Kiron, these partners may share basic data about your participation in their programs (i.e. if you attended the program or not) with Kiron.
Kiron may provide you with a non-legally binding document which says that you are enrolled at Kiron. We may ask you about the purpose of the request and will use this information for statistics and to help us identify students with the potential to transfer to a university.
You may terminate your membership with the Kiron platform at any time. For this purpose please send an email to student-support@kiron.ngo. Accounts may get disabled or deleted if we detect inactivity for an extended period of time and only if repeated notification emails remain unanswered.
Your account will be removed from our platform and live systems within maximum 5 working days.
Data related to your account may remain in our backup systems for a period of time but will be irreversibly deleted after 12 months at the latest.
When terminating your membership, all your personal data and references to you will be completely anonymized with the exception of the data, for which a legal requirement to retain exists.
Your profile in our forum (https://forum.kiron.ngo) will be anonymized. Any content you contributed to the forum, however, will remain unless specifically deleted by you.
Upon account deletion – either by students’ request or upon extended inactivity – the Google Account provided by Kiron (email address ending in @students.kiron.ngo) including the Gmail email box and the Drive cloud storage will be closed and all information will be deleted from Google’s and Kiron’s servers. The data cannot be recovered once it is deleted.
Our employees, volunteers and contractors have access to the data based on our Access control policies and are contractually bound to keep the information confidential.
Kiron uses service providers in order to operate and maintain the Kiron platform. The service providers will process the data exclusively in accordance with the instructions of Kiron and have been obliged to comply with the applicable data protection regulations. Kiron and its assigned service providers will take reasonable technical and organizational precautions in order to protect the data of the users. Depending on your use of our services different sets of data may be processed or stored, as is described in detail below.
insofar as this is required by Art. 6 para. 1 p. 1 lit. b DSGVO for the settlement of contractual relationships with you.
Any Third Party Processor which handles information on Kiron’s behalf is required to do so in accordance with contractual terms which require that the information is kept secure, is processed in accordance with applicable data protection laws, and used only as we have instructed and not for that Third Party Processor’s own purposes (unless you have explicitly consented to them doing so).
If our use of a Third Party Processor involves the transfer of personal data to a location outside of the European Economic Area, we will put appropriate measures in place to ensure that the personal data is adequately protected in that location, most often by applying European Commission-approved standard contractual clauses alongside robust security checks.
All Kiron servers and data storages are hosted at AWS and are located within the European Union.
Our Student communications, Support Ticketing system, Support Portal and knowledge base, Feedback and suggestions section are using a software solution by LiveAgent. Data including email contact information, IP-address logs as well as email content is stored on servers hosted by LiveAgent.
We use the CRM software solution provided by Hubspot, Inc, and Hubspot may store contact and correspondence information of external parties Kiron interacts with on their servers. This does not include personal information of our students.
Kiron may analyze the data collected for scientific purposes in order to conduct academic surveys and research, such as evaluating key performance indicators, social impact and scientifically analyze the services. Such research will be conducted by Kiron or its research partners either in accordance with the respective legislation, using anonymized and pseudonymized data, whenever possible, or after you have explicitly consented to be part of such research.
We may modify this policy from time to time and adjust it according to the underlying data processing. When we make changes to this policy we will inform users on our website, via app or via email.
This is the fourth version of this policy: Version 4.0 (effective May 25th 2018).
Version 3.0 (effective from 18th January 2018 to 24th May 2018) can be found here.
Version 2.1 (effective from 13th October 2016 to 17th January 2018) can be found here.
Version 2.0 (effective from 1st July to 12th October 2016) can be found here.
Version 1.2 (effective from 11th May to 30th June 2016) can be found here.
Version 1.1 (effective from 16th March to 10th May 2016) can be found here.
Version 1.0 (effective from 15th October 2015 to 15th March 2016) can be found here.

References: Art. 15
 Art. 16
 Art. 17
 Art. 20
 Art. 77
 Art. 6
 Art. 21
 Art. 6
 art. 15
 Art. 6
 Art. 6
 Art. 6
 art. 6
 Art. 6
 Art. 6