Privacy policy

Data protection declaration

for the use of the website
for the newsletter subscription
for pupils and their the legal guardian(s) regarding our services and our tutors’ services, including telephone contact and accounting
for tutors, including their acceptance test

1. Who is responsible for data processing?

The body responsible for data processing is
GoStudent GmbH
Ernst-Melchior-Gasse 20
1020 Vienna, Austria
Commercial register no.: FN 447118 b
Email: data-privacy@gostudent.org

The language used in this data protection declaration is intended to be gender neutral.

2. If you use our website as a user, in particular when making requests or enquiries or using the community area

This data protection declaration applies to our websites at the following domains:

gostudent.org
gostudent.org/en

2.1. What data is processed and where does it come from?

We process the personal data you provide to us when using the website. You are required to provide us with this data to process your requests or enquiries or to use the community area (contractually). If you do not provide us with the personal data in question, we will not be able to process your enquiry or allow use of the community area.

In addition, as part of the purposes given above, we process data that we generate for you as a user of our website and/or community, namely:

Date, employee and contents of the enquiry response
Date, person asking the question and responder and metadata and contents required for use of the community area

Please note that information about any cookies we use on the website is provided as part of our cookie tool (https://www.cookiebot.com/).

2.2. What is the legal basis for data processing?

To fulfil contractual obligations (Article 6 (1)(b) GDPR)
Personal data is processed in order to fulfil our contractual obligations as part of the use of the community area.

2.3. With whom is your data shared?

We transmit personal data to authorised data processors if this is necessary within the scope of the above purposes. All data processors are contractually obliged to treat your data confidentially and to process it only within the scope of the above-mentioned purposes:

Hetzner Online GmbH (Germany): hosting
Google Ireland Limited (Ireland): traffic analysis
HubSpot Inc. (USA; standard contractual clauses concluded): customer relationship management (CRM)

2.4. For how long will your data be processed and stored?

We store your data for:

the purpose of responding to enquiries for any claims for damages for three years after the completion of the response;
the purpose of using the community area for as long as you are a community member and beyond that for any claims for damages for three years.

3. If you subscribe to our pupil or tutor e-newsletter

3.1. What data is processed and where does it come from?

We process the personal data you provide to us when subscribing/consenting to the newsletter in question. You are required to provide us with this data to receive the newsletter. If you do not provide us with the personal data in question, we will not be able to send you either newsletter. In addition, as part of the purposes given above, we process data that we generate for you as a user of our newsletters, namely

data on consent or possible revocation (“unsubscribe”)
data for sending the respective newsletter
your use of the respective newsletter (opening or click behaviour)

3.2. What is the legal basis for data processing?

On the basis of your express consent, which can be revoked at any time (Article 6 (1) (a) GDPR)
Personal data is processed on the legal basis of your consent, which can be revoked at any time. The revocation can be made as follows (at least as easily as giving consent): via an unsubscribe link in each newsletter.

3.3. With whom is your data shared?

Mailgun Technologies Inc. (USA, standard contractual clauses concluded): email dispatch
Peaberry Software Inc. (“Customer.io”, standard contractual clauses concluded): segmentation and message dispatch
ClickSend Pty Ltd. (Australia, standard contractual clauses concluded): SMS dispatch for login codes

3.4. For how long will your data be processed and stored?

We store/process your data - until your newsletter subscription is cancelled - for the purpose of revocation management or for any claims for damages for three years from revocation

4. If you as a pupil (and as their legal guardian) make use of our services or the services of the tutors

We operate a platform for pupils (or their legal guardians) who are looking for support and for tutors. Therefore, on the one hand, platform contracts with pupils (or possibly their legal guardians) and agency contracts with tutors are concluded via our platform; pupils (or possibly their legal guardians) and tutors also conclude teacher contracts directly. The tutoring sessions take place on the basis of the teacher contracts between tutors and pupils via Zoom online video conferences (the Zoom service provider sends automated meeting links and automatically collects data on participation in the conferences).

To ensure transparency, this data protection information also includes information regarding the processing of the pupil’s personal data (or possibly that of their legal guardians) by the tutors with regard to their fulfilment of the teacher contract with the pupils. Since this processing is largely carried out via our platform, we act as a data processor for the tutors. Insofar as GoStudent has to process data in order to fulfil GoStudent’s contractual obligations, GoStudent acts on its own responsibility. Unless explicitly otherwise distinguished below, the information applies both to the processing by us as the body responsible for data protection and to the processing by the tutors as the person(s) responsible under data protection law.

4.1. What data do we process (including tutors, unless otherwise stated) and where does it come from?

We process the personal data that you provide to us as a pupil or their legal guardian about the pupil or yourself for the provision of services. You providing this information is on the one hand contractually necessary to conclude the agreements between you (as a pupil or legal guardian) and us and between you and the tutor for the agreed provision of services and on the other hand legally necessary, in particular to fulfil our accounting obligations. This also includes any data in connection with the payment of our services (see below for our payment service provider, Stripe). If you do not provide us with your relevant personal data, we cannot enter into or fulfil a contract with you.

In addition, we process personal data that we generate for you as part of our provision of services or from the sources mentioned, namely: - Service provision data for billing purposes (generated by us or meeting participation data generated by Zoom) - Invoice data to fulfil our accounting obligations (generated by us or payment confirmations from Stripe) - Any correspondence and telephone contact (support requests) related to the provision of GoStudent services

4.2. What is the legal basis for data processing?

We process your personal data to fulfil our contractual obligations, including support requests, and to comply with any other associated legal obligations, in particular under any corporate and tax law:

To fulfil contractual obligations (Article 6 (1)(b) GDPR)
Personal data is processed to fulfil our contractual obligations, in particular to fulfil our contracts with you. The purpose of data processing for the fulfilment of the contract is primarily to process the learning service we offer.

To fulfil legal obligations (Article 6 (1)(c ) GDPR)
We also process your personal data for the purpose of complying with various legal obligations to which we are subject, in particular under corporate and tax law.

To protect legitimate interests (Article 6 (1)(f) GDPR)
We process personal data to protect our legitimate interests, unless your interests in confidentiality override these. In the following cases, data processing is carried out to safeguard legitimate interests: - Advertising and marketing to existing contractual partners

You can object to the processing of personal data on the basis of legitimate interests — see below on data subject rights.

4.3. With whom is your data shared?

GoStudent transmits your personal data to the respective tutor as part of the mediation of the tutor agreement.

In addition, we engage data processors if this is necessary to fulfil the service in question. All data processors are contractually obliged to treat your data confidentially and to process it only within the scope of our assignment. We engage the following data processors:

Hetzner Online GmbH (Germany): hosting
Zoom Video Communications, Inc. (USA; standard contractual clauses (SCC) concluded): holding the video sessions
If you use WhatsApp outside the EEA: Whatsapp LLC (USA, Standard Contractual Clauses (SCC) concluded): communication channel between tutors on the one hand and between tutors and parents or students on the other hand
If you use WhatsApp in the EEA: WhatsApp Ireland Limited: communication channel between tutors on the one hand and between tutors and parents or students on the other hand
ClickSend Pty Ltd. (Australia, standard contractual clauses (SCC) concluded): SMS dispatch for login codes
HubSpot Inc. (USA; standard contractual clauses (SCC) concluded): customer relationship management (CRM)
JustCall by SaasLabs Inc. (USA, standard contractual clauses (SCC) concluded): VOIP (voice over IP) telecommunications
MessageBird B.V. (Netherlands): WhatsApp support tool using omnichannel communication

4.4. Payment service provider

We use Stripe Payments Europe Limited (‘Stripe’) as a payment service provider, which receives the credit card data entered by you and the billing data from us to process the payment services. The processing of this data for payment processing then takes place under Stripe’s own data protection responsibility (see their data protection information: https://stripe.com/at/privacy). We do not store your credit card data, only a Stripe ID, which we can use to initiate further payments with Stripe.

4.5. (Recourse) factoring

To finance the services of GoStudent, we use the following factor bank(s) to collect our receivables, to which we transmit your (invoice) data on the basis of our legitimate interests (Art. 6 (1)(f) GDPR):

aks bank GmbH & Co KG (Germany): factoring

4.6. For how long will your data be processed and stored?

We store the personal data necessary for the fulfilment of the contract at least for the duration of the entire business relationship as well as in accordance with the Austrian statutory retention and documentation obligations (e.g. in accordance with the Austrian Commercial Code or the Federal Fiscal Code), as a rule for seven years.

5. If you use our services as a tutor or provide your services to students through us as a tutor

Insofar as GoStudent processes data to fulfil GoStudent’s contractual obligations with the tutor, GoStudent acts on its own responsibility. In addition, as an intermediary platform, we process the tutor’s data on our own responsibility:

5.1 What data is processed and where does it come from?

We process the personal data that you provide to us as a tutor. You providing this information is on the one hand contractually necessary to conclude the agreements between you as a tutor and us and between you as a tutor and the pupil for the agreed provision of services and on the other hand legally necessary, in particular to fulfil our accounting obligations. This also includes any data in connection with the payment of the services (see below for our payment service provider). If you do not provide us with your relevant personal data, we cannot enter into or fulfil a contract with you.

In addition, we process personal data that we generate for you as part of our provision of services or from the sources mentioned, namely:

Quiz data to test tutor suitability (entered by you and partly generated by us, always subject to human review and assessment)
For tutors who come from the UK or work in the UK: only tutors who have an “Enhanced DBS Certificate” issued no longer than 12 months ago (also available in the UK via the partner agency New Directions Holdings Limited (“Checks Direct”, https://checksdirect.co.uk/); otherwise an equivalent national certificate from the tutor’s country of residence — with an English translation where possible). The tutors must send the current certificate together with the corresponding form and a photo ID to dbs@gostudent.org. The documents are checked to ensure they are up to date and valid, and then released.
Service provision data for billing purposes (generated by us or meeting participation data generated by Zoom)
Invoice data to fulfil our accounting obligations (generated by us or payment confirmations from our payment service provider)
Any correspondence and telephone enquiries (support requests) related to the tutors’ provision of services

5.2 What is the legal basis for data processing?

We process your personal data to fulfil our contractual obligations, including support requests, and to comply with any other associated legal obligations, in particular under corporate and tax law:

To protect legitimate interests (Article 6 (1)(f) GDPR)
We process personal data to protect our legitimate interests, unless your interests in confidentiality override these.

In the following cases, data processing is carried out to safeguard legitimate interests:

Advertising and marketing to existing contractual partners (tutors)

You can object to the processing of personal data on the basis of legitimate interests — see below on data subject rights.

5.3. With whom is your data shared?

GoStudent transmits your personal data to the respective pupil (i.e. your contractual partner) as part of the mediation of the tutor agreement.

Hetzner Online GmbH (Germany): hosting
Zoom Video Communications, Inc. (USA; standard contractual clauses (SCC) concluded): holding the video sessions
If you use WhatsApp outside the EEA: Whatsapp LLC (USA, Standard Contractual Clauses (SCC) concluded): communication channel between tutors on the one hand and between tutors and parents or students on the other hand
If you use WhatsApp in the EEA: WhatsApp Ireland Limited: communication channel between tutors on the one hand and between tutors and parents or students on the other hand
ClickSend Pty Ltd. (Australia, standard contractual clauses (SCC) concluded): SMS dispatch for login codes
HubSpot Inc. (USA; standard contractual clauses (SCC) concluded): customer relationship management (CRM) — also for tutors
JustCall by SaasLabs Inc. (USA, standard contractual clauses (SCC) concluded): VOIP (voice over IP) telecommunications
MessageBird B.V. (Netherlands): WhatsApp support tool using omnichannel communication

5.4. Payment service provider

We use Revolut Ltd., 7 Westferry Circus, Canary Wharf, London, England, E14 4HD as a payment service provider, which receives the bank details entered by you and the billing data from us to process the payment services. The processing of this data for payment processing then takes place under Revolut’s own data protection responsibility (see their data protection information: https://www.revolut.com/en-AT/legal/privacy).

5.5. For how long will your data be processed and stored?

We store the personal data (including the quiz and “Enhanced DBS Certificate” data) necessary for the fulfilment of the contract at least for the duration of the entire business relationship as a tutor as well as in accordance with the statutory retention and documentation obligations (e.g. in accordance with the Austrian Commercial Code or the Federal Fiscal Code), as a rule for seven years.

6. If you are a GoStudent applicant or employee

We process the data you provide to us as part of the application process for employment with GoStudent. We also process personal data related to employment with GoStudent.

6.1. What data is processed and where does it come from?

If you apply for a vacancy at GoStudent, we will process the application documents you send us.

In the context of your employment with GoStudent, we process all data that you provide to us as an employee or that is generated in the course of the employment relationship. You providing this information is on the one hand necessary for fulfilment of the contract and on the other hand legally necessary, in particular to fulfil our accounting obligations and tax and social security obligations.

6.2. What is the legal basis for data processing?

On the basis of your express consent, which can be revoked at any time (Article 6 (1)(a) GDPR)
Application documents are processed on the basis of your consent in accordance with Article 6 (1)(a) GDPR. The same applies to data that you provide in the employment relationship based on your voluntary consent.

6.3. With whom is your data shared?

GoStudent transmits the processed data to the respective employees. Within the scope of legal obligations, the data will be transmitted to the competent tax authorities, social security institutions and other authorities, insofar as this is legally required.

DocuSign, Inc. (USA, standard contractual clauses concluded): signatures
BambooHR (EU): personnel information system (admin tool for all employees)
HubSpot Inc. (USA; standard contractual clauses concluded): application management
Greenhouse: application management
Hetzner Online GmbH (Germany): hosting

6.4. For how long will your data be processed and stored?

We store the personal data necessary for the fulfilment of the contract at least for the duration of the entire employment relationship as well as in accordance with the statutory retention and documentation obligations (e.g. in accordance with the Austrian Commercial Code or the Federal Fiscal Code), as a rule for seven years.

7. What are your rights?

In this context, it should be noted that GoStudent operates an intermediary platform between pupils (and possibly their legal guardians) and tutors. In order to ensure transparency, this data protection information also includes information regarding the processing of the personal data of the pupil (and possibly their legal guardians) by the tutors as the responsible persons. The rights of the data subject described below can be asserted against the person responsible for processing the personal data, i.e. GoStudent or the respective tutor.

Right of withdrawal
If we process your personal data on the basis of your consent, you have the right to withdraw your consent at any time. Revoking your consent does not affect the legality of the processing carried out on the basis of the consent up to the revocation. You will be informed of this before giving your consent. The withdrawal of consent must be as easy as giving consent.

Right to information
If we process your personal data, you have the right to information about the purposes of the processing, the categories of personal data processed, the recipients of this personal data, the storage period, the rights to which you are entitled, the origin of the personal data and the possible existence of automated decision-making.

Correction and erasure
You have the right to request the correction of incorrect or incomplete personal data concerning you. You are entitled to request the erasure of personal data concerning you, provided that the processing of the data is not lawful and there are no legal obligations on our part to prevent the erasure.

Restriction of processing
You are entitled to demand that the processing of your data be restricted in certain cases.

Data portability
You have the right to request the transfer of the data that you have provided to us in a structured, common and machine-readable format. You have the right to have the personal data transferred by us directly to a responsible person named by you, insofar as this is technically feasible.

Objection
You have the right to object to the processing of personal data concerning you at any time on grounds relating to your particular situation. If you object, we will no longer continue to process personal data relating to you unless we can demonstrate that our reasons for processing outweigh your interests. You can object to the use of your personal data for advertising purposes at any time, in which case we will stop processing your data for advertising purposes. To exercise your rights with regard to your data processed by us, please contact info@gostudent.at.

Complaint
You have the right to lodge a complaint to the data protection supervisory authorities
Information Commissioner’s Office
Wycliffe House Water Lane
Wilmslow, Cheshire, SK9 5AF
Great Britain
+44 303 123 1113 or
+44 162 554 5860
E-mail: icocasework@ico.org.uk
if you believe that your data protection rights are being violated.