Privacy Policy Statement of SOFiSTiK AG

2. What data do we process and from which sources do these data originate? 

2.1 Personal Data 

Depending on your use of the software, we may process the following categories of personal data: 

• Master data (e.g., name, username) 
• Contact details (e.g., email address) 
• Login credentials 
• Usage data 
• Device information (e.g., operating system, software version) 
• Log data (log files) 
• Error and diagnostic data 
• License information 
• User-generated content 
• Communication data (when contacting support) 
• Passwords (stored in hashed and/or encrypted form) 

We only process personal data that are necessary for the respective purpose. 

2.2 Additional Personal Data 

• Software Improvement Program 

  • When you download and use our software on your device, our Software Improvement Program is enabled by default. Within this program, we collect certain technical information, including: Information about your software usage, such as the frequency and duration of use and error information (e.g., crash frequency); Information about your operating system, device type, display configuration (e.g., GPU model, number and resolution of displays); Information about your regional location, country, and language settings. 

  • We collect this information to improve the quality, stability, functionality, and hardware compatibility of our software. These technical data are not shared with third parties and are not combined with the personal data processed within your SOFiSTiK Account. Where a natural person can be identified from the processed technical information, the legal basis for processing is Article 6(1)(f) GDPR (legitimate interest). 

If you do not wish SOFiSTiK to collect your technical data, you may disable this feature at any time, for example by using a Windows Registry key or through the settings in the SOFiSTiK Application Manager.

• User Account: Your personal data are processed to: 
  • create your SOFiSTiK Account; 
  • identify you as a user; 
  • contact you in case of technical issues; 
  • carry out marketing activities; 
  • ensure convenient use of our software products. 

Processing is carried out at your request and is necessary for the purposes of our legitimate interests pursuant to Article 6(1)(f) GDPR. You will receive a registration email that must be confirmed in order to activate your SOFiSTiK Account (double opt-in procedure). Your confirmation serves as proof that you are the person who initiated the registration. Unless statutory retention obligations pursuant to Article 6(1)(c) GDPR apply, or you have consented to a longer retention period under Article 6(1)(a) GDPR, your SOFiSTiK Account data will be deleted after 37 months. 

• Diagnostic Data 

  • To improve software stability, security, and error analysis, the software may process technical diagnostic data, event logs, or crash information. Personal data are processed only to the extent necessary for these purposes. 

• Security Logs 

  • Security-related events may be logged in order to detect attacks, analyze security incidents, and ensure the integrity of the software. 

• Telemetry

  • Where telemetry data are collected, this is done solely for the purposes described in this Privacy Policy and in compliance with applicable data protection laws. If enabled, the software may transmit technical diagnostic information such as: 

    • Crash reports 
    • Error messages 
    • Operating system version 
    • Software version 
    • Technical device information 

These data are transmitted exclusively to improve software stability and security. Where telemetry is optional, it can be disabled at any time in the software settings. 

• Support 

  • If you contact our support team, we process the information you provide, including in particular: 

    • Name 
    • Email address 
    • Content of your request 
    • Attachments 
    • Technical information required to resolve the issue 

• Server Log Files 

  • Our hosting provider automatically collects and stores information transmitted by your browser in server log files. This includes: 

    • Date and time of the request; 
    • Name of the requested file; 
    • Website from which the file was requested; 
    • Access status (e.g., file transferred, file not found); 
    • Web browser and operating system used; 
    • Full IP address of the requesting computer; 
    • Volume of data transferred. 

These data are not merged with other data sources. Processing is based on Article 6(1)(f) GDPR and our legitimate interest in improving the stability and functionality of our website. Where technically feasible, processing is carried out in encrypted form. For technical security reasons, particularly to defend against attacks on our web server, these data are stored temporarily. It is not possible for us to identify individual users based on these data. After no later than seven days, IP addresses are anonymized by shortening them at domain level so that they can no longer be linked to individual users. Anonymous data may additionally be processed for statistical purposes. They are not matched with other data sets nor disclosed to third parties, even in part.

• Use of the Moodle Learning Platform  

  • We use the Moodle learning platform to provide training, continuing education, and informational content. In connection with the use of Moodle, personal data are processed to the extent necessary for the creation and administration of user accounts, the delivery of courses, and the provision of learning content. The following categories of personal data may be processed in particular: 

    • Master data (e.g., name, username) 
    • Contact details (e.g., email address) 
    • Login and log data (e.g., login times, IP address, browser information) 
    • Course and learning data (e.g., course enrollments, progress, test results, certificates) 
    • Communication data (e.g., forum posts, messages, and comments within the platform) 

The data are processed for the purpose of providing and administering the learning platform, conducting training activities, documenting learning progress, and ensuring system security and the proper operation of the platform. 

The legal basis for processing is Article 6(1)(b) GDPR where processing is necessary for the performance of a contract or pre-contractual measures. Where Moodle is used in the context of an employment relationship, processing is based on Article 6(1)(b) GDPR and, where applicable, Section 26 of the German Federal Data Protection Act (BDSG). Processing may also be based on Article 6(1)(f) GDPR. Our legitimate interest lies in the secure and efficient provision of a digital learning platform. 

Personal data are generally retained only for as long as necessary to conduct the training activities, comply with statutory retention obligations, or establish, exercise, or defend legal claims. User accounts and associated data are deleted or anonymized once the purpose of processing no longer applies, unless statutory retention obligations require otherwise. 

Where Moodle is hosted by an external service provider, personal data are processed under a data processing agreement pursuant to Article 28 GDPR. Where personal data are transferred to countries outside the European Union or the European Economic Area, such transfers are carried out exclusively in compliance with Articles 44 et seq. GDPR. 

4. Are You Required to Provide Your Data? 

The processing of your personal data is necessary for the conclusion and performance of the contract entered into with us. If you do not provide the required data, we may be unable to conclude the contract or continue performing an existing contract and may therefore have to terminate it. However, you are not obliged to consent to the processing of personal data that are not required for the performance of the contract or by law. 

6. How Long Are Your Data Stored? 

Personal data are retained only for as long as necessary for the purposes for which they were collected or where statutory retention obligations apply. Once the relevant purpose no longer exists, the personal data are deleted unless legal retention obligations require continued storage. 

8. Security 

We have implemented appropriate technical and organizational security measures to protect your personal data against loss, destruction, manipulation, and unauthorized access. All employees and service providers working on our behalf are required to comply with applicable data protection laws. 

Whenever personal data are collected and processed, they are encrypted before transmission to prevent misuse by unauthorized third parties. Our security measures are continuously reviewed and improved, and this Privacy Policy is regularly updated. Please ensure that you are using the latest version. 

10. Cookies

When you visit our website, we may store information on your computer in the form of cookies. Cookies are small files that are transferred from a web server to your browser and stored on your device. Only the Internet Protocol (IP) address is stored in this process; no additional personal data are stored. 

The information stored in cookies enables us to recognize your browser automatically during your next visit, thereby making the use of our website more convenient. You may, of course, use our website without accepting cookies. 

If you do not wish your computer to be recognized on future visits, you can disable cookies by changing your browser settings accordingly. Instructions can be found in the documentation provided by your browser. Please note, however, that disabling cookies may limit the functionality of certain areas of our website. 

12. What data protection rights do I have? 

You have the right to information, correction, deletion or restriction of the processing of your stored data, a right to object to the processing and a right to data portability and to lodge a complaint at any time in accordance with the requirements of data protection law. 

12.1 Right of Access

You can request information from us as to whether and to what extent we process your data. 

12.2 Right to Rectification

If we process your data incompletely or incorrectly, you can request that we correct or complete it at any time. 

12.3 Right to Erasure

You can request that we erase your data if we process it unlawfully or if the processing disproportionately interferes with your legitimate protection interests. Please note that there may be reasons that prevent immediate erasure, e.g. in the case of statutory retention or processing obligations. 

Irrespective of the exercise of your right to erasure, we will erase your data immediately and completely, provided that there is no legal or statutory retention obligation to the contrary. 

12.4 Right to Restriction of processing

You can request that we restrict the processing of your data if 

• you contest the accuracy of the data, for a period enabling us to verify the accuracy of the data 
• the processing of the data is unlawful, but you refuse to have it erased and instead wish to restrict the use of the data 
• we no longer need the data for the intended purpose, but you still need this data to assert or defend legal claims, or 
• you have objected to the processing of the data. 

12.5 Right to Object

If we process your data on the basis of legitimate interest, you can object to this at any time. This would also apply to profiling based on these provisions. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing serves the establishment, exercise or defense of legal claims. You can object to the processing of your data for the purpose of direct advertising at any time without giving reasons. 

12.6 Right to Data Portability

You may request that we provide you with the data you have provided to us in a structured, commonly used and machine-readable format and that you may transmit this data to another controller without hindrance from us, provided that 

• we process this data on the basis of your revocable consent or to fulfill a contract between us, and this processing is carried out using automated procedures. 

If technically feasible, you can request that we transfer your data directly to another controller. 

12.7 Right to Lodge a Complaint with a Supervisory Authority

If you are of the opinion that we are violating German or European data protection law when processing your data, please contact us so that we can clarify any questions. Of course, you also have the right to contact the supervisory authority responsible for you, the respective state office for data protection supervision. 

If you wish to assert one of these rights against us, please contact our data protection officer. In case of doubt, we may request additional information to confirm your identity. 

12.8 Right to Withdraw Consent 

If we process your data on the basis of consent, you can withdraw this consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. 

12.9 Automated individual decision-making, including profiling 

You have the right not to be subject to a decision based solely on automated processing - including profiling - which produces legal effects concerning you or similarly significantly affects you.