I. Controller and Data Protection Officer; Contact

The controller responsible for data processing within the meaning of data protection laws is:

DIHK - Gesellschaft für berufliche Bildung

Organisation zur Förderung der IHK-Weiterbildung gGmbH

Holbeinstr. 13-15

53175 Bonn
Germany

Telephone: +49 / 228 6205101

datenschutz@wb.dihk.de

This applies insofar as you attend a course offered by DIHK - Gesellschaft für berufliche Bildung - Organisation zur Förderung der IHK-Weiterbildung gGmbH. If you attend an event organised by your CCI/AHK, the respective CCI/AHK is the controller responsible for the processing, and we act as its processor. The data processing operations described below are carried out in the same manner in both cases. In the latter case, the legal basis for our processing is always the processing agreement concluded with your CCI/AHK.

Should you have any questions or suggestions concerning data protection, you are welcome to contact us.

You can contact our Data Protection Officer as follows:

Scheja und Partners GmbH & Co. KG

Attorney-at-law Boris Reibach

Adenauerallee 136

53113 Bonn
Germany

Contact: https://www.scheja-partner.de/kontakt/kontakt.html or info@scheja-partner.de

II. Subject Matter of Data Protection

The subject matter of data protection is personal data. This means any information relating to an identified or identifiable natural person, also referred to as the data subject. This includes, for example, information such as name, postal address, email address or telephone number, as well as information that necessarily arises when using our website, such as information about the start, end and scope of use.

III. Purposes and Legal Bases of Processing

1. Processing when using the Learning Platform

1.1. Log Files

We process and store personal data where this is necessary for the operation of the learning platform pursuant to Article 6 para.1 f) GDPR. When you visit the platform, we store the following log information in a file, known as log files, and in the database:

the date and time of your visit to the learning platform, the name of the actor and data subject in the case of administrative changes, the context of the results (for example system, course and user), the components used( for example system, forum, password, module, etc.), as well as technical information concerning your platform visit (including technical abbreviations with system IDs, origin and IP address).

The purposes pursued include:

• ensuring data security;
• ensuring data availability;
• remedying errors and malfunctions;
• preventing criminal offences and misuse of our products and services.

Your log data can no longer be viewed by us after 30 days.

1.2. Cookies

The learning platform uses cookies, inter alia, to make the offer more user-friendly and effective. Cookies are small text files that are stored on your device but do not contain any viruses or cause any damage.

"Moodle ID" Session Cookie

To make it easier for you to log in to your profile, we use the "Moodle ID" cookie. As a necessary cookie pursuant to Article 6 para.1 f) GDPR, it stores your login data in the web browser, maintains a user session, tracks your navigation between the different pages of our web offering and remains on your device even after you log out. When you next visit the website, your login name and password will already be pre-filled for login.

The cookie contains a randomly generated session ID. When you close and reopen the browser, a new session starts with a new session ID and the old cookie is deleted by the browser. You can prevent cookies from being stored by adjusting your browser settings accordingly. Please note that this may restrict the functionality and scope of our offering. If you do not allow this cookie to be set, you will have to enter your login name and password again each time you visit.

The purposes pursued include:

• ensuring data security;
• ensuring data availability;
• remedying errors and malfunctions;
• preventing criminal offences and misuse of our products and services.

We also process your personal data for the purposes of the legitimate interests pursued by us or a third party pursuant to Article 6 para. 1 f) GDPR, such as:

• providing and operating the learning platform.

You have the right to object to this processing as described in the section "Rights of the User" below.

The cookie is automatically deleted after the end of your session.

1.3. Links to other websites

We may occasionally include links to other websites on the learning platform. Websites and services of other providers to which we link are designed and provided by third parties. We have no influence over the design, content or functionality of these third-party services.

Please note that third-party offerings linked to our website may install their own cookies on your device outside our sphere of influence or collect personal data. We have no influence over this. Please obtain information directly from the providers of these linked third-party offerings, regarding the type, scope, legal basis and storage period of the processing.

2. Processing in connection with the delivery of courses and project groups

Our learning platform is used to deliver courses, training sessions, instruction sessions and briefings, and to work in study groups and project teams, hereinafter referred to as learning courses. Participation is voluntary and, in some cases, takes place in the context of mandatory requirements of DIHK-Bildungs-gGmbH. In connection with the delivery of learning courses, we also process your personal data, such as usage data( meaning information about your activities in connection with the learning platform, for example courses attended, progress in learning courses, last visit to a course, activities in learning courses, where applicable assessments such as test results or assignment grades); access data( for example date and time of dial-in, dial-in number); and connection metadata, for example meeting topic, IP address and device information).

2.1. Processing for the purpose of fulfilling the contract

If you participate in one of the learning courses offered, we process your personal data insofar as this is necessary for your participation in the learning courses pursuant to Article 6 para. 1 b) GDPR. The purposes include in particular:

• enrolment, organization and delivery of learning courses, including your registration;
• generation and dispatch of enrolment confirmations, invitations, documents, confirmations of participation and, where applicable, certificates;
• preparation and follow-up of learning courses;
• course-centered communication with course instructors and participants, including via the forum provided;
• collaborative work by participants, including glossary, wiki directory/study folder, jointly created text pages and created databases;
• provision of learning materials, including audio and video files, and further readings in a document directory, database, wiki or glossary, as well as via the lightbox gallery;
• completion of lessons, assignments and tests;
• organization of learning paths;
• assessment of tests, assignments and project work;
• management of projects and learning processes, including Kanban board.

With your personal user access, you have the option to view the data relating to you. In your personal user profile, you also have the option to request a report containing your personal data or to request its deletion.

Data from the courses is stored for up to six months after the end of the course or until the data is no longer required for verification or audit purposes. Discussion posts in forums and entries in glossaries or wikis are deleted when the course is deleted.

Your user account will be deleted if you are not enrolled in any of our courses. When your account is deleted, your previous posts, comments and content are anonymized. In all cases, we store your personal data only for as long as this is necessary to fulfil the purposes described above.

2.2. Processing based on our legitimate interests

We also process your personal data for the purposes of the legitimate interests pursued by us or a third party pursuant to Article 6 para. 1 f) GDPR, such as:

• participation management;
• record of mandatory training;
• management of appointments;
• allocation to learning groups;
• improvement of learning courses;
• enabling collaboration within the learning courses;
• follow-up of learning courses, in particular evaluation of submitted feedback;
• dispatch of subject-related information;
• ensuring IT security.

You have the right to object to this processing as described in the section "Rights of the User" under section 8.

Data from the courses is stored for up to six months after the end of the course or until the data is no longer required for verification and audit purposes. Discussion posts in forums and entries in glossaries or wikis are deleted when the course is deleted.

2.3. Processing to fulfill legal obligations

We also process your personal data to comply with legal obligations to which we are subject pursuant to Article 6 para. 1 c) GDPR. Such obligations may arise, for example, from commercial law, tax law, prevention of money laundering law, financial law or criminal law.

2.4. Conducting audio and video conferences

We process your data for the transmission and display of audio and video, for example data from the microphone or video camera of the device used, to enable or facilitate your participation in audio and video conferences and thus to communicate in real time during the event. The purpose of conducting audio and video conferences is collaboration with course participants and course instructors. If you wish to restrict processing, you may of course disable our device`s camera and/or mute your microphone at any time.

We use the following services to conduct audio and video conferences:

• Zoom;
• BigBlueButton.

Please note: If you access the website of the services used to participate in audio and video conferences, the respective provider is responsible for the data processing. Regarding the processing of personal data by the provider, we refer to their privacy notices:

• Zoom: https://explore.zoom.us/de/privacy/
• BigBlueButton: https://www.bigbluebutton-hosting.de/unternehmen/datenschutz/

When using the providers mentioned above, various categories of data are processed. For invitations, we use the contact details that you provided to us during registration. We also process information that you provide when participating in audio and video conferences. Where such information is linked to your person, it also constitutes personal data. This may include, for example, your contributions or content shared by you during audio and video conferences, such as presentations and documents. In addition, depending on the medium used, further data, known as metadata, such as IP addresses, is collected when participating in audio and video conferences. Your log data can be viewed by our administrators for 30 days only. Beyond this, none of your personal data is stored with the providers on a long-term basis.

We process this data only insofar as this is necessary for the smooth running of audio and video conferences. We conduct audio and video conferences in the context of a contractual relationship with you pursuant to Article 6 para. 1 b) GDPR or in the context of a business relationship with the CCI whose continuing education measure you use pursuant to Article 6 para.1 f) GDPR. With your consent, data processing may also include image and sound recordings of conferences, including video and audio recordings, presentations, text files, audio files or log files, pursuant to Article 6 para. 1 a) GDPR and Section 25 para. 1, sentence 1 TDDDG.

3. Recipients or categories of recipients of personal data

Within our organization, only those people who need to have access to your data need it to perform their duties within the scope of the purposes set out in this Privacy Policy. We disclose your personal data to external recipients outside DIHK-Bildungs-gGmbH only where this is necessary to process or handle your request, where another statutory authorization exists, or where you have given us your consent.

External recipients may include:

• Processors

Service providers that we use to provide services, for example in the areas of technical infrastructure and maintenance for our offering or the provision of content. We select these processors carefully and review them regularly to ensure that your privacy is protected. The service providers may use the data exclusively for the purposes specified by us.

• Public Bodies

Authorities and public institutions, such as public prosecutors' offices, courts or tax authorities, to which we are required to transmit personal data for legally mandatory reasons. Likewise, the CCI, AHK or corresponding educational institution responsible for you receives information about the individual course dates on which you participate, whether you meet the access criteria for the final test and whether the course you attend in is eligible for funding under BAföG.

• Course instructors

Course instructors receive access to your learning history, your contributions and the results of your tests and assignments for the respective course, insofar as this is necessary for the design and delivery of the course. Course instructors also have access to the content you share during video conferences. There is no cross-course access.

• Other Participants

Other participants can view the list of participants in the course room, which contains your name. In addition, other participants can view your profile and the data you have made publicly available in the context of your communication and collaboration as well as the video conferences in which you have participated.

• Non-Public Bodies

Traders or auxiliary people to whom data is transmitted based on consent or mandatory necessity.

4. Storage Period

After completion of the course, the course room and all documents and content contained therein are archived for six months. After expiry of the six-month period, the data is permanently deleted. If you are not enrolled in any courses that still exist, your data will be deleted. In addition, you have the option to delete your own entries or to request deletion of your data via the learning platform. If you are an employee of DIHK-Bildungs-gGmbH or a course instructor, we will also delete your account when our cooperation ends.

Furthermore, we ensure that prohibited communications are regularly deleted.

In all cases, we store your personal data only for as long as this is necessary to fulfil the purposes described above or, in the case of consent, for as long as you have not withdrawn your consent. In the event of an objection, we will erase your personal data unless further processing is permitted under the relevant legal provisions.

5. Sources

In the context of data processing for the delivery of courses and project groups, we primarily process the personal data that you provide to us. We may occasionally receive your contact details from your CCI or AHK to carry out your registration.

Assessments and evaluations are created by the course instructor responsible or, in the case of peer assessments, by other participants.

6. Automated decision-making

Assessments or evaluations of your performance may occasionally be created automatically by the system. No automated decision-making takes place in this context.

7. Transfers to Third Countries

In some cases, your data is transferred to another body whose registered office or place of data processing is not located in a Member State of the European Union or in another contracting state to the Agreement on the European Economic Area.

Where no adequacy decision by the European Commission exists for the third country, before transferring the data we seek to ensure an adequate level of data protection for the transfer of personal data outside the EEA by concluding appropriate agreements with the recipients, which are regularly based on the EU Standard Contractual Clauses.

8. Rights of the User

As a data subject affected by the data processing, you have the following rights:

• Right of access
  You have the right to obtain information about the data concerning you that we store.
• Right to rectification and erasure
  You may request that we rectify inaccurate data and, where the legal requirements are met, erase your data.
• Restriction of processing
  You may request that we restrict the processing of your data, where the legal requirements are met.
• Data portability
  If you have provided us with data based on a contract or consent, you may, where the statutory requirements are met, request to receive the data you have provided in a structured, commonly used and machine-readable format or request that we transmit it to another controller.

Right to object to the processing of personal data based on our legitimate interests:

If we process your personal data for the protection of our legitimate interests (Art. 6 para. 1 f) GDPR) you have the right to object to this processing at any time on grounds relating to your situation. If you exercise your right to object, we will stop processing your data unless we can demonstrate - in accordance with the legal requirements - compelling legitimate reasons for further processing that outweigh your rights.

You may also lodge a complaint with the competent supervisory authority if you believe that the processing of your data violates applicable law. For this purpose, you may contact the data protection authority responsible for your place of residence or your country, or the data protection authority responsible for us.

Contacting Us

Furthermore, if you have any questions regarding the processing of your personal data, your rights as a subject of data or any consent you may have given, you can contact us free of charge. To exercise any of your rights referred to above, please contact datenschutz@wb.dihk.de or write to the postal address specified above under section 1. Please ensure that we can clearly identify you.

Version

The current version of this Privacy Policy applies.

Version: 1st July 2026