Privacy policy

VE Vision Education GmbH
FN 462915h
c/o Impact Hub Vienna GmbH
Lindengasse 56
1070 Vienna
(hereinafter “We” or the “Operator”)

Last update: October 12th, 2022

1. Preamble

1.1. The protection of rights to privacy for our users in the processing of personal data is a fundamental right which we take very seriously. All data processing is carried out in accordance with the EU Data Protection Basic Regulation (hereinafter referred to as “GDPR”) and the relevant laws of the Republic of Austria.

1.2. In this document, we explain our procedures regarding the collection, use and disclosure of the personal data of users (hereinafter referred to as “data subjects”), which we collect and process in the course of our service provision and business operations.

1.3. This notice applies to the contact data of our contractual partners (or their representatives and employees, hereinafter referred to as “partner data”), which we process in the area of corporate customers (hereinafter referred to as “partner data”), to data which we collect from the user in the course of using our software (hereinafter referred to as “user data”) and to data which is processed in connection with our website (hereinafter referred to as “web visitor data”).

1.4. The data subject can access the current version of the Privacy Policy at any time at https://learnmatch.net/en/privacy-policy-learnmatch-kids/. Should this Privacy Policy change, the data subject will be informed through their app or via the contact details provided by the data subject. In the case of translated versions of the Privacy Policy, the German version shall be the authoritative version in case of doubt.

1.5. We store personal data only on secure servers that are operated in secure facilities, which are equipped with state-of-the-art firewall protection. The data that we collect may be transferred to, and stored or processed by, employees who work for us or for one of our suppliers for the sole purpose of providing services and support.

2. Purposes, data categories and legal bases for the processing of partner data

2.1. We process personal partner data using the categories listed in 2.2 for the following general purposes:

• to make contact with the contractual partner,
• to fulfil pre-contractual and contractual obligations,
• to provide the services offered,
• to answer questions and comments,
• to provide support services and,
• where appropriate, to inform the contractual partner about news at regular intervals.

2.2. In the course of the initiation of business and in the processing of contracts with partners, we may process partner data under the following data categories:

• first and last name,
• e-mail address, including e-mail traffic and correspondence data in general,
• telephone number and other contact details (Messenger-IDs, website address, etc.).

2.3. The legal basis for the processing of personal data mentioned in 2.2 is our predominant legitimate interest according to Art. 6 para. 1 lit f GDPR, which consists of achieving the purposes mentioned in 2.1. The processing of partner data is required to enable us to contact (potential) contractual partners and to conduct our business operations.

2.4. If the contractual partner is an individual person and the processing of their data is absolutely necessary for the performance of the contract, the lawfulness of the data processing also results from this necessity (Art. 6 para. 1 lit b GDPR).

2.5. Furthermore, the processing of data may be necessary and therefore lawful on the basis of the need to comply with legal obligations (Art. 6 para. 1 lit. c GDPR).

3. Purposes, categories of data and legal bases for the processing of user data

3.1. We process personal user data using the categories listed in 3.2 for the following general purposes:

• to make contact with a contractual partner,
• to fulfil pre-contractual and contractual obligations,
• to provide the services offered,
• to answer questions and comments,
• for the purposes of e-mail marketing and market research, provided that the data subject has given his/her express consent to such processing,
• to provide support services and,
• where appropriate, to inform the contractual partner about news at regular intervals.

3.2. We may process user data using the following categories for those who use our software offer:

• technical electronic communication metadata (e.g. IP address, cookie data, software and hardware characteristics),
• username,
• first and last name,
• e-mail address,
• telephone number,
• date of birth,
• spoken and learnt languages,
• other personal information entered by the service and the settings specified,
• a profile picture if necessary,
• where appropriate, data on the implementation of cashless payments, and
• transaction data (for purchases), as well as interactive user data (such as learning progress and app usage behaviour).

3.3. The legal basis for the processing of personal data listed above in 3.2 is our predominant legitimate interest according to Art. 6 para. 1 lit f GDPR, which consists of achieving the purposes in 3.1. The processing of user data is necessary to enable us to offer our software and services and to enable us to contact users.

3.4. If there is a contract between the user and us and if the processing of the user’s data is absolutely necessary for the fulfilment of the contract, the lawfulness of data processing also results from this necessity (Art. 6 para. 1 lit b GDPR).

3.5. Occasionally we offer “combination packages”, in which we compile and “brand” various goods and services for customers together with cooperation partners. For this purpose it is necessary that we forward relevant data to our cooperation partners. Cooperation partners are vicarious agents in the sense of § 1313a ABGB (Austrian Civil Code), since without our cooperation partners it is not possible for us to provide the end customer with the combined package. The forwarding of data is therefore absolutely necessary for the fulfilment of the contract, hence the lawfulness which results from this necessity (Art. 6 para. 1 lit b GDPR). In addition, the data subject is informed separately about data transfer before the contract is concluded and his or her separate consent is obtained. The legality of the transfer of data is therefore also based on the consent of the data subject (Art. 6 para. 1 lit. a GDPR).

3.6. Furthermore, the processing of data may be lawful on the basis of the need to comply with legal obligations (Art. 6 para. 1 lit. c GDPR).

4. Purposes, categories of data and legal bases for the processing of web visitor data

4.1. We process personal web visitor data using the categories listed in 4.2 for the following general purposes:

• to provide users with the website and to continue to improve and develop the website,
• to detect, prevent and investigate attacks on the website,
• to respond to requests,
• to show special versions of our services and
• to create website usage statistics.

4.2. We may process the following web visitor data of all persons who visit our website:

• the IP address of the visitor and the date and time of visit, brand name and version of web browser as well as language setting selected, operating system, Internet Service Provider and website (URL) from which the web visitor was referred to the website,
• the information that web visitors enter voluntarily into the contact form (i.e. name, e-mail address and message) or in the download menu (i.e. the user’s telephone number) and
• cookies.

4.3. The processing of this web visitor data is necessary to achieve the purposes in 4.1 lit. a – d and to enable the website to be offered. With regard to the purposes listed in 4.1 lit. a – d, the legal basis for the processing of personal data is based on our overriding legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR, which is to achieve the purposes mentioned in points a – d and to be able to offer the website to users.

4.4. If there is a contract between the user and the Operator and if the processing of the user’s data is absolutely necessary for the fulfilment of the contract, the lawfulness of data processing also results from this necessity (Art. 6 para. 1 lit b GDPR).

4.5. Furthermore, the processing of data may be lawful on the basis of the need to comply with legal obligations (Art. 6 para. 1 lit. c GDPR).

4.6. We use “cookies” to improve the operation of the website. Cookies are small text files that can be stored on the user’s computer when the user visits a website. Cookies are generally used to provide users with additional functions on a website. Cookies cannot access, read or modify other data on the user‘s computer.

4.7. We use both cookies that are deleted when the browser is closed (session cookies) and cookies that remain stored on the terminal device after the browser is closed (permanent cookies). The cookies that we use may originate both from ourselves (first party cookies) and from third parties (third party cookies). The website uses Google Analytics (a web analysis service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”)) in order to be able to fulfil the purpose of “website usage statistics” mentioned in 4.1 lit. e.

4.8. Some cookies are technically absolutely necessary for the function of our website. The use of these cookies is lawful according to Art. 6 para. 1 lit. f GDPR, as we have a legitimate interest in being able to offer a functioning website.

4.9. All other cookies which are not absolutely necessary for the functioning of the website (such as cookies set by Google Analytics) are only used on the basis of the voluntary consent of the person concerned (Art. 6 para. 1 letter a GDPR). This consent is requested the first time our website is opened on a user’s device. If consent is not given, we will only use cookies that are technically absolutely necessary.

4.10. If consent is denied, it is not possible for us to compile user statistics in order to improve our offer. If the use of cookies is refused by the majority of users, the functionality of our website may be limited.

4.11. In order to revoke consent or to restrict it to certain cookies, users should be aware that:

• a link in the website footer can be used to access the website’s “cookie manager”, in which the cookie settings can be changed at any time.
• cookie settings can also be changed within the user‘s browser settings. Details can be found in the help function of the browser (usually accessible via the F1 key on the keyboard).

4.12. The revocation of consent to data collection has no bearing on the lawfulness of any processing that took place before revocation.

4.13. The cookies we use in detail:

5. Place of data processing and transmission of personal data

5.1. In order to achieve the purposes mentioned above in 2, 3 and 4, it is necessary to transfer data to external service providers. In the course of carrying out the data applications mentioned above in 2, 3 and 4, data will need to be forwarded to recipients of the following categories:

• our IT service providers (see 5.7 for detail),
• banks, where this is necessary for the implementation of cashless payments and
• processing partner for communication.

5.2. In specific individual cases it may also be necessary to transfer data to the following recipients in the following categories:

• cooperation partners (see 3.5 and 5.3),
• chartered accountant and tax consultant,
• lawyers and
• public bodies (e.g. courts, police, administrative authorities).

5.3. Occasionally we offer “combination packages”, in which we compile and “brand” various goods and services for customers together with cooperation partners. For this purpose it is necessary that we forward relevant data to our cooperation partners. Separate consent will be sought in each individual case.

5.4 Data may be transferred to one of our distribution partners, as they are responsible for the first level support of our customers. For this purpose, it is therefore necessary that we forward the data to our sales partners. The lawfulness [or legality] of such data transfer arises from the mandatory nature of the transaction, covered by the terms of this contract.

5.5. Data transfer may also occur if our company or parts of our company are taken over by a third party or if our company or parts of our company are merged with another company. Before personal data is transferred and subject to other data protection guidelines, we will inform those affected in good time.

5.6. Data processing activities may, at least in part, be carried out outside the EU/EEA. Assignment of an external IT service provider is necessarily subject only to the legal instruments of Chapter V of the GDPR. The appropriate level of data protection is determined in each case by one or more of the following points:

• an adequacy finding by the European Commission under Art 45 GDPR,
• an exception for the specific case under Art 49 (1) GDPR,
• binding internal data protection regulations in accordance with Art. 47 in conjunction with Art 46. para. 2 lit b GDPR,
• standard data protection clauses according to Art. 46 para. 2 lit. c and d GDPR,
• approved rules of conduct pursuant to Art. 46 para. 2 lit e in conjunction with Art. 40 GDPR,
• an approved certification mechanism in accordance with Art. 46 para. 2 lit f in conjunction with Art. 42 GDPR,
• contractual clauses approved by the data protection authority in accordance with Art. 46 para. 3 lit a GDPR.

5.7. We currently use the following external IT service providers:

Google LLC, Google Data Protection Office, 1600 Amphitheatre Pkwy, Mountain View, California 94043. This service provider stores registration data, learning progress data, e-mails and document storage, as well as customer-related calendar data, if applicable. Google LLC is based in the USA. The transfer of data by us to Google LLC is carried out on the basis of standard data protection clauses in accordance with Art. 46 para. 2 lit c and d GDPR as well as on the basis of contractual clauses in accordance with Art. 46 para. 3 lit a GDPR approved by the relevant competent data protection authority, which can be accessed at https://firebase.google.com/terms/firebase-mcc, thus ensuring an appropriate level of data protection and permitting the flow of data to this company.

Horizon Alpha GmbH, Fraunhoferstraße 8, D-82152 Planegg, Germany. This subcontractor is responsible for processing customer data for reporting, code management, learning progress data and customer data management and is responsible for second level technical support.

SendinBlue, Rue D’Amsterdam, Paris, France. This service is used by us to send marketing and CRM emails and messages. For this purpose, a separate declaration of consent is obtained from our users and the relevant stored e-mail address is sent to SendInBlue.

Amplitude Inc, 631 Howard St. Floor 5, San Francisco, USA (“Amplitude”). This service enables us to analyse and measure user behaviour and the performance of various advertisments within the app. For this purpose, the user’s calling IP address (in anonymised form) is transmitted for evaluation.

Amplitude Inc. is based in the USA. The transfer of data by us to Amplitude is carried out on the basis of standard data protection clauses in accordance with Art. 46 para. 2 lit c and d GDPR as well as on the basis of contractual clauses approved by the respective competent data protection authority in accordance with Art. 46 para. 3 lit a GDPR, which are available at [https://learnmatch.net/wp-content/uploads/2020/11/Amplitude_Order_Form_and_DPA-neutral.pdf], whereby an appropriate level of data protection is guaranteed and the flow of data to this company is permitted. Further information on data protection at Amplitude can be found at https://amplitude.com/privacy].

Freshworks Inc.,(formerly known as Freshdesk Inc.) 2950 S. Delaware St, Suite 201, San Mateo, CA 94403,U.S.A.. This service provider processes and stores your email address, your contact details sent to the Customer Support and, if necessary, your IP address.

5.8. Apart from the flow of data to these external IT service providers, data transfer may be necessary to comply with legal requests after data have been submitted, to comply with court orders or legal proceedings, to establish or exercise legal rights or to defend against legal claims. We may also disclose information when we believe that disclosure is necessary to investigate or prevent illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, or violations of the Terms of Use, or when we are required to do so by law.

6. Data from minor children

6.1. We respect the privacy of all our users, especially children. We do not process any personal data of or relating to children. The data required for registration is exclusively personal data from the parents who are registering on behalf of the child. Only when the child uses a device to log in to the app, will the IP address of that device be processed by us.

6.2 If the user identifies themselves as a child when submitting a support request, we will not store any personal data.

7. Duration of storage

7.1. We only process personal data for as long as necessary to achieve the above-mentioned purposes. Personal data that we process in accordance with point 2 above is stored for the duration of the contract initiation, contractual relationship and (potential) partnership with the contractual partner/partner.

7.2. We store personal data that we process in accordance with point 3 above for the duration of the contract initiation, contractual relationship and as long as the user has a user profile stored with us.

7.3. We store personal data that we process in accordance with 4.2 letter a for a period of 36 months. Personal data that we process in accordance with 4.2 letter b is stored for the duration of the contract initiation, contractual relationship and as long as the user has a user profile stored with us.

7.4. Longer storage is only carried out if the storage or processing of the data is longer necessary:

• in order to fulfil a legal obligation (e.g. the obligation under tax law to retain data in accordance with Section 132 (1) of the Austrian Federal Fiscal Code (BAO) and the obligation under company law to retain data in accordance with Sections 190, 212 of the Austrian Commercial Code (UGB): 7 years), which requires processing in accordance with the law of the Union or the Member States to which we are subject, or in order to perform a task in the public interest or in the exercise of official authority which has been assigned to us, or
• to assert, exercise or defend legal claims.

8. Rights and obligations of the data subject

8.1. If our processing of data is based exclusively on the consent of the person concerned, he/she is entitled to revoke his/her consent at any time. In addition, according to the applicable data protection law, the person concerned has the right:

• to check whether and which personal data we have stored and to receive copies of this data,
• to request the correction, completion or deletion of personal data which is incorrect or not processed in accordance with the law,
• to require us to limit the processing of data,
• to object, under certain circumstances, to the processing of personal data or to revoke the consent previously given for such processing,
• to require data transferability,
• to ascertain the identity of third parties to whom personal data is transmitted and
• to lodge a complaint with the data protection authority responsible for the Operator (i.e. the Austrian Data Protection Authority Barichgasse 40-42, 1030 Vienna) or with a data protection supervisory authority in another EU member state, in particular at the place of residence or work of the user concerned.

8.2. The provision of data is mandatory for contractual rather than legal reasons in order to enter into a contractual relationship with us and to use our services. Refusal to provide the data in accordance with points 2, 3 or 4 above may render us unable to fulfil our obligations to the user.

8.3. The data collected are not processed by means of automated decision-making including profiling, in accordance with Art. 22 GDPR.

9. Confidentiality and security

9.1. The Operator takes measures to protect personal data with appropriate and industry standard security measures against loss or theft as well as against access, disclosure, duplication, misuse or modification by unauthorised persons. Personal data is password protected and, unless otherwise specified in this privacy policy, is only accessible to the Operator and our service providers. The user undertakes to keep their password or passwords secret and not to disclose them to any other person or allow their disclosure.

9.2. The Operator restricts access to personal data to those employees of its own company, affiliated companies and external service providers who, in the reasonable opinion of the Operator, need such data in order to deliver products or services or to perform their tasks.

9.3. The Operator has physical, electronic and procedural security devices that comply with the regulations for the protection of personal data. However, it is not possible to guarantee one hundred percent security for data transfers on the Internet. For this reason, the Operator cannot guarantee or warrant the security of data that the user transfers for the fulfilment of the contract. In particular, access to and use of the service is exclusively at the user’s own risk. It is also the user’s responsibility to restrict access to their terminal device and to ensure that it is free of malware of any kind, which may track data entered into the service, such as e-mail addresses and payment data.

9.4. The Operator is expressly not liable for loss or damage resulting from non-compliance with this section by the user.

9.5. Payment for paid services is handled by the Operator via secure payment providers or directly via the relevant AppStores to ensure the security of payments according to general industry standards.

10. Contact with the operator

10.1. If you have any questions or concerns regarding the processing of your personal data, please contact us:

VE Vision Education GmbH

c/o Impact Hub Vienna GmbH

Lindengasse 56

1070 Vienna

info@visioneducation.net