Privacy policy

This privacy policy explains the type, scope and purpose of the processing of personal data (hereinafter “data”) on the website vaialabs.ai and its pages, functions and content, as well as on our online presences, such as our profiles in social networks (together the “online offering”). For the terms used, such as “processing” or “controller”, we refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR).

Controller

StudySmarter GmbH
Bahnbogen 21
81671 Munich
Germany

Email: hello@vaialabs.ai
Managing directors: Simon Hohentanner, Till Söhlemann, Christian Felgenhauer, Maurice Khudhir
Imprint: vaialabs.ai/imprint

Vaia Labs is a brand of StudySmarter GmbH.

Data protection officer

You can reach our data protection officer by email at datenschutzbeauftragter@studysmarter.de or by post at the address above, marked for the attention of the data protection officer.

Types of data processed

• Master data, for example names, company and position
• Contact data, for example email addresses and telephone numbers
• Content data, for example messages and documents you send us
• Usage data, for example pages visited and time of access
• Meta and communication data, for example device information and IP addresses

Categories of data subjects

Visitors and users of the online offering, as well as prospective customers, customers, business partners and applicants who contact us. In the following, we refer to the data subjects together as “users”.

Purposes of processing

• Providing the online offering, its functions and content
• Answering enquiries and communicating with users
• Preparing and performing contracts, for example for pilot projects
• Security measures

Terms used

“Personal data” means any information relating to an identified or identifiable natural person (“data subject”). A natural person is identifiable if they can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (for example a cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

“Processing” means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and covers practically any handling of data.

“Pseudonymisation” means the processing of personal data in such a way that the data can no longer be attributed to a specific data subject without the use of additional information, provided that this additional information is kept separately and is subject to technical and organisational measures which ensure that the data is not attributed to an identified or identifiable natural person.

“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Relevant legal bases

In accordance with Art. 13 GDPR, we inform you of the legal bases of our data processing. Unless the legal basis is stated in this privacy policy, the following applies: the legal basis for obtaining consent is Art. 6 (1) (a) and Art. 7 GDPR; the legal basis for processing to provide our services, to carry out contractual measures and to answer enquiries is Art. 6 (1) (b) GDPR; the legal basis for processing to comply with our legal obligations is Art. 6 (1) (c) GDPR; and the legal basis for processing to protect our legitimate interests is Art. 6 (1) (f) GDPR. Where the vital interests of the data subject or of another natural person make the processing of personal data necessary, Art. 6 (1) (d) GDPR serves as the legal basis.

Security measures

In accordance with Art. 32 GDPR, and taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.

These measures include in particular safeguarding the confidentiality, integrity and availability of data by controlling physical access to the data, as well as access to, input, transfer and separation of the data, and securing their availability. We have also established procedures to ensure that data subjects can exercise their rights, that data is deleted and that we respond to threats to the data. We take the protection of personal data into account when developing or selecting hardware, software and processes, in line with the principle of data protection by design and by default (Art. 25 GDPR).

This website is transmitted using TLS encryption. You can recognise an encrypted connection by “https://” in the address bar of your browser.

Cooperation with processors and third parties

If, in the course of our processing, we disclose data to other persons and companies (processors or third parties), transfer data to them or otherwise grant them access to data, we do so only on the basis of a legal permission, for example if the transfer is necessary to perform a contract (Art. 6 (1) (b) GDPR), if you have consented, if a legal obligation requires it or on the basis of our legitimate interests, for example when we use hosting providers.

If we commission third parties to process data on the basis of a data processing agreement, we do so in accordance with Art. 28 GDPR.

Transfers to third countries

If we process data in a third country, meaning outside the European Union (EU) or the European Economic Area (EEA), or if this happens in the context of using third-party services or of disclosing or transferring data to third parties, this only takes place to fulfil our (pre)contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we only process data in a third country, or have it processed there, if the special requirements of Art. 44 et seq. GDPR are met. This means, for example, that the processing takes place on the basis of an adequacy decision of the European Commission, such as the one for companies in the USA that are certified under the EU-US Data Privacy Framework, or on the basis of standard contractual clauses adopted by the European Commission.

This website is stored and delivered from within the EU. Some of our service providers belong to groups of companies based in the USA. Where data may be transferred to the USA in this context, the transfer is based on the EU-US Data Privacy Framework or on standard contractual clauses.

Rights of data subjects

You have the right to obtain confirmation as to whether data concerning you is being processed, and to obtain access to this data, further information and a copy of the data in accordance with Art. 15 GDPR.

In accordance with Art. 16 GDPR, you have the right to have incomplete data concerning you completed or inaccurate data concerning you corrected.

In accordance with Art. 17 GDPR, you have the right to demand that data concerning you be deleted without delay or, alternatively, in accordance with Art. 18 GDPR, to demand that the processing of the data be restricted.

You have the right to receive the data concerning you that you have provided to us in accordance with Art. 20 GDPR and to request its transfer to other controllers.

In accordance with Art. 77 GDPR, you also have the right to lodge a complaint with a supervisory authority. The supervisory authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.

Right to withdraw consent

You have the right to withdraw any consent you have given with effect for the future in accordance with Art. 7 (3) GDPR.

Right to object

You can object to the future processing of data concerning you at any time in accordance with Art. 21 GDPR. Where we process data on the basis of our legitimate interests (Art. 6 (1) (f) GDPR), you can object on grounds relating to your particular situation. You can object to processing for the purposes of direct marketing at any time.

Cookies

“Cookies” are small files that are stored on users’ devices and can contain various information. This website does not use cookies or comparable technologies that store information on your device or access information already stored on your device. We do not use analytics, tracking or advertising tools on this website.

If we introduce such technologies in the future, we will ask for your consent beforehand where this is required under § 25 (1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Art. 6 (1) (a) GDPR, and we will update this privacy policy.

Deletion of data

The data we process is deleted or its processing restricted in accordance with Art. 17 and 18 GDPR. Unless expressly stated otherwise in this privacy policy, the data stored by us is deleted as soon as it is no longer required for its purpose and no statutory retention obligations prevent deletion. If data is not deleted because it is required for other legally permissible purposes, its processing is restricted. This means that the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax reasons.

Under German law, data is retained in particular for 10 years in accordance with § 147 (1) of the German Fiscal Code (AO) and § 257 (1) and (4) of the German Commercial Code (HGB) (books, records, annual financial statements, management reports), for 8 years for accounting vouchers and for 6 years for commercial and business letters.

Business-related processing

In addition, we process

• contract data, for example the subject matter of the contract, its term and the customer category
• payment data, for example bank details and payment history

of our customers, prospective customers and business partners in order to provide our contractual services, for service and customer care, and for marketing and market research within the limits permitted by law. The legal bases are Art. 6 (1) (b) and (f) GDPR.

Administration, financial accounting, office organisation and contact management

We process data in the course of administrative tasks and the organisation of our business, financial accounting and compliance with legal obligations, such as archiving. In doing so, we process the same data that we process in the course of providing our contractual services. The legal bases are Art. 6 (1) (c) and (f) GDPR. The persons concerned are customers, prospective customers, business partners and website visitors. Our purpose and interest lie in administration, financial accounting, office organisation and the archiving of data, meaning tasks that serve to maintain our business activities, to perform our tasks and to provide our services. The deletion of data relating to contractual services and contractual communication follows the information given for these processing activities.

In this context, we disclose or transfer data to the tax authorities and to advisers such as tax advisers or auditors, as well as to other fee offices and payment service providers.

We also store information on suppliers, event organisers and other business partners on the basis of our business interests, for example for the purpose of contacting them later. We store this mostly company-related data for as long as it is needed for the business relationship.

Contacting us and pilot requests

When you contact us, for example by email, by telephone or via social media, or when you request a pilot, the information you provide is processed to handle your enquiry in accordance with Art. 6 (1) (b) GDPR. If your enquiry is not related to a contract, the legal basis is our legitimate interest in answering enquiries (Art. 6 (1) (f) GDPR). The information can be stored in a customer relationship management system (CRM system) or a comparable system for organising enquiries.

We delete enquiries once they are no longer required. We review the necessity every two years; statutory archiving obligations also apply.

Applications

Experts apply for projects on Talents, the job platform of the StudySmarter Group. The privacy policy of Talents applies there. When experts join a project, we provide separate privacy information, for example on the verification of identity and professional licences.

If you send us an application directly, for example by email, we process your data only for the purpose and within the scope of the application procedure in accordance with the legal requirements. The legal basis is Art. 6 (1) (b) GDPR and, where processing becomes necessary for us, for example in legal proceedings, Art. 6 (1) (f) GDPR.

The application data required usually includes personal details, postal and contact addresses and the documents belonging to the application, such as a cover letter, CV and certificates. Applicants can also voluntarily provide additional information. If special categories of personal data within the meaning of Art. 9 (1) GDPR are voluntarily provided in the course of the application procedure, they are also processed in accordance with Art. 9 (2) (b) GDPR.

Please note that emails are generally not sent encrypted. We cannot accept responsibility for the transmission path between the sender and receipt on our server.

If the application is successful, the data provided can be processed further for the purposes of the contractual relationship. Otherwise, the data is deleted six months after the end of the application procedure, so that we can answer any follow-up questions and meet our obligations to provide evidence under the German General Equal Treatment Act (AGG). Applicants can withdraw their application at any time.

Hosting and email

The hosting services we use provide the following services: infrastructure and platform services, computing capacity, storage space, email sending, security services and technical maintenance, which we use to operate this online offering.

This website is stored with Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, in the Frankfurt region in Germany, and delivered through the content delivery network of BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia.

In doing so, we and our hosting providers process master data, contact data, content data, contract data, usage data and meta and communication data of customers, prospective customers and visitors to this online offering on the basis of our legitimate interests in the efficient and secure provision of this online offering in accordance with Art. 6 (1) (f) GDPR in conjunction with Art. 28 GDPR (data processing agreement).

Collection of access data and log files

On the basis of our legitimate interests within the meaning of Art. 6 (1) (f) GDPR, we or our hosting providers collect data on every access to the server on which this service is located (server log files). The access data includes the name of the page and file accessed, the date and time of access, the amount of data transferred, a notification of successful access, the browser type and version, the user’s operating system, the referrer URL (the previously visited page), the IP address and the requesting provider.

For security reasons, for example to investigate misuse or fraud, log file information is stored for a maximum of 7 days and then deleted. Data that must be retained for evidence purposes is excluded from deletion until the incident in question has been finally clarified.

Fonts

This website uses the fonts Plus Jakarta Sans and Inter Tight. The fonts are stored on our own servers and loaded from there. No connection is established to servers of Google or other font providers.

Online presences in social media

Where we maintain online presences in social networks and platforms, for example on LinkedIn, we do so in order to communicate with the customers, prospective customers and users active there and to inform them about our services. When you access the respective networks and platforms, the terms and conditions and the data processing policies of their operators apply.

Unless otherwise stated in this privacy policy, we process users’ data if they communicate with us within the social networks and platforms, for example by writing posts on our online presences or by sending us messages. LinkedIn is operated by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Its privacy policy is available at linkedin.com/legal/privacy-policy.

Third-party content and links

We do not embed any content or services from third parties on this website, such as videos, maps, social media plugins or fonts loaded from third-party servers.

This website contains links to other websites, for example to Talents, Trustpilot, press articles and the websites of our investors. These are simple links: data is only transferred to the respective provider when you follow a link. We have no influence on the processing of data by these providers; their own privacy policies apply.

Automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Obligation to provide data

You are not obliged by law or by contract to provide personal data to us. However, without the data we may not be able to answer your enquiry or to conclude a contract with you.

Changes to this privacy policy

We adapt this privacy policy when our data processing changes, for example when we introduce new services or features. The current version is always available on this page.