Data Privacy Policy

I. Data controllers and contact with the data protection officers

The University Course is conducted by Tomorrow University of Applied Sciences in cooperation with the Executive Academy of the Vienna University of Economics and Business. Within the framework of this cooperation, the parties jointly determine the purposes and means of the processing and are insofar deemed to be joint data controllers within the meaning of the GDPR. Below you will find the contact details of the joint controllers:

WU Vienna University of Economics and Business
Executive Academy (hereinafter WU EA)
Welthandelsplatz 1
1020 Vienna

&

ToU gGmbH (hereinafter Tomorrow) 

Platz der Einheit 2

60327 Frankfurt am Main

‍

Tomorrow's data protection officer is Intelliant GmbH, Immanuelkirchstr. 3-4, 10405 Berlin, Germany, reachable at dpo@intelliant.de or online via https://intelliant.de/contact/.

The data protection officer of WU EA can be reached at: Vienna University of Economics and Business (WU), Attn: Data Protection Officer p.A. Legal Department, Welthandelsplatz 1, Building AR, 1020 Vienna, and by e-mail at datenschutzbeauftragter@wu.ac.at.

II. Functions and relationships of the jointly responsible persons

As joint controllers, Tomorrow and WU EA have entered into an agreement to protect your data subject rights, which regulates in detail which of the controllers are subject to which data protection obligations. Within the scope of joint responsibility, WU EA is responsible for processing your personal data in connection with enrollment and your studies (including examinations), and Tomorrow is responsible for processing data in connection with your application, the use of technical services and the implementation of study operations. 

If you have any questions about the processing of your data, you can contact us at any time by email at privacy@tomorrowseducation.com as the central point of contact. 

Notwithstanding the foregoing, you may generally contact any of the joint data controllers with any questions you may have regarding data protection and to assert your data subject rights. When responding to your inquiries, the controllers may cooperate and exchange information about your inquiry and the stored data (e.g., we provide each other with information necessary to respond to requests for information). 

‍

III. Processing of personal data 

1. Data that we process when you use our services

When you use Tomorrow’s Services, personal data is processed for technical reasons each time you access Tomorrow’s Services. 

As soon as you use these services, your browser or terminal device sends technical information to Tomorrow's web servers, which is stored in server log files. The following usage and web access data is processed:

• the date and time of the visit and the duration of the use of the website;
• the IP address of your device;
• the referral URL (the website from which you may have been redirected);
• the sub-pages of the website visited; and
• other information about your device (device type, browser type and version, settings, installed plug-ins, operating system, language).

This so-called usage data is processed exclusively in pseudonymous form to enable you to use the services and to ensure the functionality of the services. The data is generally not used to identify you as a person. In addition, we process the pseudonymous usage data to analyze the performance of the website, to continuously improve the website and to correct errors or to personalize the content of the website for you. Finally, we also process the usage data to ensure IT security and the operation of our systems and to prevent or detect misuse, in particular fraud. These server log files are deleted after a maximum of 7 days. The legal basis for the processing of this data is Art. 6 (1) lit. f) GDPR, the protection and functionality of the services are legitimate interests of the responsible parties in this sense.

Cookies and other tracking tools: We use cookies to provide the technical functions for automatic processing of usage data. You can find more information here. 

2. Data processing in connection with your application for the University Course

When you apply for our University Course, Tomorrow processes personal data about you that you provide, for example, via web forms. These are:

• Salutation
• Name, gender, preferred pronouns
• Contact details: Email address, phone number
• Country of residence
• Information about your academic achievements
• Information about your work experience
• Letter of motivation, personal mission statement
• Date of application.

These data are required, 

• to be able to identify you as an interested party,
• to check the entered data for plausibility, 
• to pre-screen you to see if you are eligible to participate in the University Course,
• for any queries and to conduct interviews with the applicants,
• to inform you about the status of your application and 
• to provide you with further information related to the conduct of your studies as well as other educational offerings from Tomorrow.  

The data processing is carried out upon your request and is necessary according to Art. 6 (1) lit. b) and lit. f) GDPR for the stated purposes for the fulfillment of the contract and for other pre-contractual measures as well as on the basis of our legitimate interests. If you are not considered as a participant for the University Course, your data will be deleted immediately, at the latest, however, after 6 months. In all other cases, your data will be stored for as long as is necessary to achieve the stated purposes or as part of a legal storage period and then routinely deleted. 

‍

3. Data processing in connection with your admission to the University Course and enrollment

After successful completion of the application process, you can enroll for the University Course at WU EA. For this purpose, WU EA requires the following data from you: 

• Name, gender 
• Contact details: Address, email address, phone number
• Date of birth
• Citizenship, place of birth, country of birth
• Social security number
• Matriculation number, last university
• Letter of motivation, resume, photo
• Passport copy
• Other evidence of your education. 

For more information on how WU EA uses this data, as well as the purposes and legal basis, please click here.

‍

4. Data processing in connection with the use of the eLearning platform for the implementation of the University Course.

After successful enrollment, you will receive your initial access data for the platform by email, which you can subsequently edit (e.g. by assigning an individual password).  

During the course of your studies, additional personal data about you (e.g., name, matriculation number, photo, work files and results, video calls, assessments, competencies, learning history, interests, conversations, study progress) may be processed by the shared controllers through the Services provided by Tomorrow. You will also have the opportunity to evaluate learning formats during the course of your studies. Evaluations are conducted anonymously. In certain cases, you can also provide us with direct and explicitly non-anonymous feedback on the further development of the learning experience, both in terms of content and technology. 

According to Art. 6 (1) lit. b) and lit. f) GDPR, the data processing is necessary for the aforementioned purposes for the fulfillment of the contract and on the basis of our legitimate interests. Your data will be stored for as long as is necessary to achieve the stated purposes or as part of a statutory storage period and then routinely deleted. 

WU EA is exclusively responsible for the evaluation of your academic achievements, the administration of grades, accounting and awarding of the academic degree. You can find more information here.

‍

IV. Recipients

Data may be disclosed to third parties if we are legally obligated to do so, or if this serves the assertion of legal claims on our part or the defense against legal disputes. In these cases, the legal basis is either a legal obligation (Art. 6 (1) lit. c) GDPR) or our legitimate interests (Art. 6 (1) lit. f GDPR).

Data recipients also include the third-party providers mentioned in our overview of cookies and analytics tools. Detailed information about the third-party providers we use in this context, e.g. for web analytics, can be found in the information about cookies, web analytics and other tracking technologies at the end of this privacy statement. 

‍

1. Integrated services (processors) 

In connection with the implementation of the study as an eLearning format, Tomorrow also uses technical service providers who process personal data of you on behalf of and according to the instructions of Tomorrow. For this purpose, Tomorrow has concluded data processing agreements (DPAs) with these service providers. Through these agreements, the service providers assure that the data will be processed in accordance with the applicable data protection regulations, exclusively on documented instructions from Tomorrow, and that your data subject rights will be protected. 

Your personal data will only be disclosed by Tomorrow to recipients if this is necessary for the provision of the Services. The use is made pursuant to Art. 6 (1) lit. f) GDPR due to our legitimate economic interest to provide our offer and make it interactive and pursuant to Art. 6 (1) lit. b) GDPR to provide our services. We only use processors that offer suitable guarantees in accordance with Art. 46 GDPR and conclude corresponding agreements with them.  

‍

Amazon Web Services

Tomorrow's Services are hosted on servers provided by Tomorrow's contracted service provider Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg (hereinafter "AWS"). In connection with the hosting, AWS processes personal data on Tomorrow's behalf that is collected when using the platform.

Tomorrow has chosen Frankfurt exclusively as its server location.

Tomorrow has concluded a DPA with AWS. Through this contract, the service provider assures that it processes the data in accordance with the GDPR and ensures the protection of the rights of the data subject.

For more information about AWS and data protection, please see AWS's Notice on Data Protection and the General Data Protection Regulation.

‍

Google Workspace 

For the provision of work material in connection with the studies as well as for cooperation and communication between students and between teachers and students, the platform Google Workspace, a service of Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland (hereinafter: "Google") is integrated. Tomorrow will only pass on the email address generated by Tomorrow for the login as well as your name to these service providers. In addition, the service providers process further personal data that is generated during the use of the services, e.g. in connection with video conferencing or when using the chat functions. You can voluntarily provide further information, e.g. deposit your photo in Slack. However, this is not required.  

Tomorrow has entered into a DPA with Google. 

‍

Slack

For cooperation and communication between students and between teachers and students, the platform Slack, a service of Slack Technologies Limited, One Park Place, 4th Floor, Hatch Street, Dublin 2, Ireland, (hereinafter "Slack") is integrated. Tomorrow only shares the email address generated by Tomorrow for the login as well as your name with these service providers. In addition, the service providers process further personal data that is generated when using the services, e.g. in connection with video conferencing or when using the chat functions. You can voluntarily provide further information, e.g. deposit your photo in Slack. However, this is not required.  

Tomorrow has entered into an DPA with Slack.

‍

Auth0

For identity and access management, the service Auth0 of Auth0 Inc, 10800 NE 8th St Ste 700, Bellevue, WA 98004, USA (hereinafter "Auth0") is used, which offers a so-called single sign-on functionality. Hereby, the email address generated by Tomorrow for registration is processed. Tomorrow has concluded a DPA with Auth0, including EU standard contractual clauses for the use of Auth0. Through this contract, Auth0 assures that they process the data in accordance with the GDPR and ensure the protection of the rights of the data subject. 

‍

HubSpot

In order to communicate with you as part of the application process and to optimize Tomorrow’s Services as part of the application process, Tomorrow uses HubSpot, a service provided by HubSpot Germany GmbH, Am Postbahnhof 17, 10243 Berlin, Germany ("HubSpot"). HubSpot, on behalf of Tomorrow and at Tomorrow's direction, processes your name, email address, telephone number, date of birth, application materials, information about your use of the Tomorrow website, and other data in connection with your interaction with Tomorrow's services and as part of your application to Tomorrow. This information is stored on servers operated by HubSpot. Tomorrow has entered into a DPA with HubSpot. Through this agreement, HubSpot assures that they process the data in accordance with the GDPR and ensure the protection of the rights of the data subject. For more information on data processing by HubSpot, please visit https://legal.hubspot.com/de/privacy-policy.

‍

V. Duration of storage

Tomorrow processes and stores your personal data to the extent necessary to achieve the purposes or to comply with legal obligations. Therefore, Tomorrow stores the data for the duration of the University Course and after termination only to the extent and for as long as required by law, relying on Tomorrow's internal deletion policy. If the data is no longer required to achieve the purpose or to fulfill legal obligations (e.g. tax or commercial law), it will be automatically deleted, unless further processing is required to preserve evidence or to defend legal claims against Tomorrow. Tomorrow deletes the data of rejected applicants after six months. 

‍

VI. Your rights under the GDPR

Under the GDPR, you can exercise the following rights against the joint controllers:

Your right to information and disclosure pursuant to Art. 15 GDPR, in particular, you may request information about the processing purposes, the category of personal data, the categories of recipients to whom your data have been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right of complaint, the origin of your data, if not collected by Tomorrow, as well as the existence of automated decision-making, including profiling, and, if applicable, meaningful information about its details. 

Your right to rectification according to Art. 16 GDPR, e.g. if your data is incomplete or incorrect, you can request Tomorrow to correct it. 

Your right to erasure pursuant to Art. 17 GDPR, if this is not (any longer) necessary for the exercise of the right to freedom of expression and information, for the fulfillment of a legal obligation, for reasons of public interest or for the assertion, exercise or defense of legal claims. 

Your right to restriction of processing pursuant to Art. 18 GDPR. You may request that your data be blocked, e.g. because you believe the data to be inaccurate or the processing to be unlawful, but you object to its erasure because you need it to assert, exercise or defend legal claims or you have objected to the processing pursuant to Art. 21 GDPR. 

Your right to data portability according to Art. 20 GDPR. You may request that Tomorrow transfers data you have provided to us in a structured, commonly used and machine-readable format to you or to another controller. 

Finally, you also have the right to lodge a complaint with the competent data protection supervisory authority (Art. 77 GDPR). You can file this complaint both at your place of residence, at your place of work or at the place of the data protection violation you are complaining about. You can also file a complaint with the supervisory authority at our registered offices.

In addition, you can also revoke a given consent at any time. However, this revocation only applies for the future. Any processing that took place before the revocation remains unaffected. If you wish to exercise your rights as a data subject, you may also do so by contacting privacy@tomorrowseducation.com.

‍

VII. Information about your right to object according to Art. 21 GDPR

In addition to the rights already mentioned, you have the right to object to the processing of your personal data at any time on grounds relating to your particular situation, provided that such processing is carried out on the basis of Art. 6 (1) lit. f) GDPR (data processing on the basis of a balance of interests). If you object, Tomorrow will no longer process your personal data unless we can demonstrate circumstances that override your interests, rights and freedoms and therefore justify the processing.

You also have the right to object at any time to the processing of your personal data for the purpose of direct marketing (including the subscription to our newsletter) without incurring any costs other than the transmission costs according to the prime rates; this also applies to the creation of a user profile (so-called "profiling"), insofar as this is associated with direct marketing. If you object, Tomorrow will no longer process your personal data in the future.

Please note that you may not be able to use the website or Services, or may only be able to use them to a limited extent, if you do not provide us with certain data or if you object to the use of this data. The objection can be submitted informally to privacy@tomorrowseducation.com. 

‍

VIII. The use of cookies, web analytics and other tracking tools 

When using the Tomorrow website and the Services of Tomorrow, usage data is collected in the context of so-called "web tracking". This means that the behavior of certain users can be tracked pseudonymously to improve our services, personalize and optimize the display of advertising. Tomorrow also uses cookies for this purpose.

What are cookies? Cookies are small text files containing information that are stored on your access device. They are usually used to associate a user with a particular action or preference on a website, but without identifying the user as a person or revealing their identity.

Cookies are not automatically good or bad, but it is worth understanding what you can do about them and making your own decision about your data. 

Tomorrow uses the following types of cookies on the Website, the scope and functionality of which are explained below: Session Cookies and Persistent Cookies.

Session cookies are automatically deleted when you close your browser. This applies in particular to session cookies. They store a so-called session ID, with which various requests of your browser can be assigned to the common session. This allows your computer to be recognized when you return to the Tomorrow website. Session cookies are deleted when you log out or close your browser. 

Persistent cookies are also initially stored when you close your browser, and then automatically deleted after a certain period of time, which may vary depending on the cookie. You can delete the cookies at any time in the security settings of your browser.

The use of cookies serves on the one hand to make the use of the Tomorrow offer more pleasant for you. We use so-called session cookies to recognize that you have already logged into your user account. These are automatically deleted after you leave the session.

In addition, Tomorrow also uses temporary cookies to optimize the user experience, which are stored for a certain period of time on your device. If you visit our site again to use our services, it is automatically recognized that you were already at Tomorrow and which entries and settings you have made, so that you do not have to enter them again.

The data processed by cookies are necessary for the aforementioned purposes to protect the legitimate interests of Tomorrow pursuant to Art. 6 (1) p. 1 lit. f GDPR. Most browsers accept cookies and pixels automatically. However, you can configure your browser so that no cookies are stored on your computer or a notice always appears before a cookie is created. However, the complete deactivation of cookies may mean that you cannot use all functions of the Tomorrow website. You can prevent the use of pixels on our pages by using appropriate tools or browser add-ons (e.g. the add-on "AdBlock" for the Firefox browser).

‍

Cookies based on your voluntary consent in Consent Management

Hotjar

On the other hand, Tomorrow uses Art. 6 para. 1 p. 1 lit. a GDPR-cookies and pixel tags from Hotjar, if you have explicitly agreed via our Consent Management Tool, in order to statistically record the use of our platform and for the purpose of optimizing our offer. The provider is Hotjar Ltd, Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 1000, Malta, Europe (website: https://www.hotjar.com).

You can revoke your consent at any time with effect for the future. In the description in section 7, we explain how to revoke your consent.  

With Hotjar we can record your mouse and scroll movements and clicks, among other things. Hotjar can also determine how long you have remained with the mouse pointer on a certain spot. From this information, Hotjar creates so-called heat maps, which can be used to determine which offers are viewed preferentially.

Furthermore, we can determine how long you stayed on a page and when you left it. We can also determine at which point you abandoned your entries in a contact form (so-called conversion funnels).

You can get comprehensive information about each cookie we use in our Consent Manager.