Data Privacy

1) Introduction and Contact Information of the Data Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we provide information about how we handle your personal data when you use our website. Personal data refers to any data that can be used to personally identify you.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is the Center for International Comparative Education Studies (ZIB) e.V., Technical University of Munich, Arcisstraße 21, 80333 Munich, Germany, Tel.: 089 289 28471, Email: wisskomm.zib@sot.tum.de. The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

2) Data Collection When Visiting Our Website

2.1 When you use our website for informational purposes only—that is, if you do not register or otherwise provide us with information—we collect only the data that your browser transmits to the website server (so-called “server log files”). When you visit our website, we collect the following data, which is technically necessary for us to display the website to you:

- The website you visited

- Date and time of access

- Amount of data transmitted in bytes

- Source/referrer from which you accessed the page

- Browser used

- Operating system used

- IP address used (if applicable: in anonymized form)

Processing is carried out in accordance with Art. 6(1)(f) GDPR based on our legitimate interest in improving the stability and functionality of our website. The data will not be disclosed or used for any other purpose. However, we reserve the right to review the server log files retrospectively should there be concrete indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries to the controller), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the “https://” prefix and the lock icon in your browser address bar.

3) Cookies

To make your visit to our website more engaging and to enable the use of certain features, we use cookies—small text files stored on your device. Some of these cookies are automatically deleted when you close your browser (so-called “session cookies”), while others remain on your device for a longer period and allow page settings to be saved (so-called “persistent cookies”). In the latter case, you can find the storage duration in the overview of your web browser’s cookie settings.

If personal data is also processed by individual cookies we use, the processing is carried out in accordance with Art. 6(1)(b) GDPR either for the performance of the contract,

pursuant to Art. 6(1)(a) GDPR in the event of consent, or pursuant to Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website as well as a user-friendly and effective design of the site visit.

You can configure your browser to be notified when cookies are set and decide individually whether to accept them, or to exclude the acceptance of cookies in specific cases or generally.

Please note that if you do not accept cookies, the functionality of our website may be limited.

4) Contacting Us

Personal data is collected when you contact us (e.g., via the contact form or email). The specific data collected when using a contact form is indicated on the respective contact form. This data is stored and used exclusively for the purpose of responding to your inquiry or for establishing contact and the associated technical administration.

The legal basis for processing this data is our legitimate interest in responding to your inquiry pursuant to Art. 6(1)(f) GDPR. If your contact is aimed at concluding a contract, the additional legal basis for processing is Article 6(1)(b) of the GDPR. Your data will be deleted after your inquiry has been fully processed. This is the case when it can be inferred from the circumstances that the matter in question has been conclusively resolved and provided that no statutory retention obligations preclude this.

5) Use of Customer Data for Direct Marketing

Subscription to Our Email Newsletter

If you subscribe to our email newsletter, we will regularly send you information about our offers. The only mandatory information required to receive the newsletter is your email address. Providing additional data is voluntary and is used to address you personally. We use the so-called double opt-in procedure to send the newsletter. This means that we will only send you an email newsletter once you have expressly confirmed that you consent to receiving the newsletter. We will then send you a confirmation email asking you to click on a corresponding link to confirm that you wish to receive the newsletter in the future.

By activating the confirmation link, you grant us your consent to the use of your personal data in accordance with Art. 6(1)(a) GDPR. When you subscribe to the newsletter, we store your IP address as recorded by your Internet Service Provider (ISP), as well as the date and time of your subscription, in order to be able to trace any potential misuse of your email address at a later date. The data we collect when you subscribe to the newsletter is used exclusively for the purpose of sending you promotional communications via the newsletter. You can unsubscribe from the newsletter at any time by clicking the link provided in the newsletter or by sending a message to the controller named at the beginning of this notice. Once you have unsubscribed, your email address will be immediately deleted from our newsletter distribution list, unless you have expressly consented to further use of your data or we reserve the right to use your data for other purposes that are permitted by law and about which we inform you in this statement.

6) Web Analytics Services

Matomo

This website uses a web analytics service provided by the following provider: InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand, (“Matomo”)

To protect website visitors, Matomo uses a so-called “config_id” to enable various analyses of website usage within a short time window of up to 24 hours. The “config_id” is a randomly generated, time-limited hash of a limited set of the visitor’s settings and attributes. The config_id or config hash is a string calculated for a visitor based on their operating system, browser, browser plugins, IP address, and browser language. Matomo does not use device fingerprinting and uses an anonymized IP address of the site visitor to generate the “config_id”.

If the information processed in this manner includes personal user data, the processing is carried out in accordance with Art. 6(1)(f) GDPR based on our legitimate interest in the statistical analysis of user behavior for optimization and marketing purposes. To object to the processing of your visitor data in the future, we provide a separate opt-out option on our website.

Data is only transferred to the provider if the service is not hosted on our own servers. In the case of self-hosting, no data collected via the service is transferred to the provider.

If the service is not hosted on our own servers, we have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

For data transfers to New Zealand, an adequacy decision by the European Commission applies in this case, certifying compliance with European data protection standards for international data transfers.

7) Rights of the Data Subject

7.1 Applicable data protection law grants you the following data subject rights (rights of access and intervention) vis-à-vis the controller regarding the processing of your personal data, whereby reference is made to the cited legal basis for the respective conditions for exercising these rights:

- Right of access pursuant to Art. 15 GDPR;

- Right to rectification pursuant to Art. 16 GDPR;

- Right to erasure pursuant to Art. 17 GDPR;

- Right to restriction of processing pursuant to Art. 18 GDPR;

- Right to be informed pursuant to Art. 19 GDPR;

- Right to data portability pursuant to Art. 20 GDPR;

- Right to withdraw consent pursuant to Art. 7(3) GDPR;

- Right to lodge a complaint pursuant to Art. 77 GDPR.

7.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA BASED ON A BALANCING OF INTERESTS DUE TO OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO SUCH PROCESSING WITH EFFECT FOR THE FUTURE ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA IN QUESTION. HOWEVER, WE RESERVE THE RIGHT TO CONTINUE PROCESSING IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING IS NECESSARY FOR THE ESTABLISHMENT, EXERCISE, OR DEFENSE OF LEGAL CLAIMS.

IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR THE PURPOSE OF SUCH MARKETING. YOU MAY EXERCISE THIS RIGHT AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE RELEVANT DATA FOR DIRECT MARKETING PURPOSES.

8) Duration of storage of personal data

The duration of the storage of personal data is determined by the respective legal basis, the purpose of processing, and—where applicable—additionally by the respective statutory retention period (e.g., retention periods under commercial and tax law).

When processing personal data based on explicit consent pursuant to Art. 6(1)(a) GDPR, the data in question will be stored until you withdraw your consent.

If statutory retention periods exist for data processed within the scope of contractual or quasi-contractual obligations based on Article 6(1)(b) of the GDPR, this data is routinely deleted upon expiration of the retention periods, provided they are no longer necessary for the performance or initiation of a contract and/or we no longer have a legitimate interest in further storage.

When processing personal data based on Article 6(1)(f) of the GDPR, this data will be stored until you exercise your right to object under Article 21(1) of the GDPR, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.

When processing personal data for the purpose of direct marketing based on Article 6(1)(f) of the GDPR, this data will be stored until you exercise your right to object under Article 21(2) of the GDPR.

Unless otherwise specified in the other information in this statement regarding specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.

Copyright Notice: This privacy policy was prepared by the specialist attorneys at IT-Recht Kanzlei and is protected by copyright (https://www.it-recht-kanzlei.de)

As of: April 10, 2026, 10:41:28