Privacy Policy

Datenschutzerklärung

1. Controller

The controller responsible for data processing on this website under the GDPR is:

Jose Martinez
[Street and house number]
[Postal code and city]
Germany
Email: contact@scholarway.net

We are not required to appoint a data protection officer. For any privacy question, write to the address above.

2. Summary

• This website sets no cookies and stores nothing in your browser, except one technically necessary cookie when you open a personal PDF link from our email (section 5).
• We measure visits with self-hosted, cookieless analytics (Umami) on our own server; no data goes to third parties. There is no advertising or social media plugin.
• On the pages with the newsletter form we count, without cookies or personal data, how many visitors see, start and send the form (section 5).
• Fonts are served from our own server; your browser makes no requests to Google.
• We only process personal data when you visit the site (technical server logs) and when you choose to send us a message or subscribe to the newsletter.

3. Hosting and server log files

This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. When you open a page, your browser automatically transmits information that is recorded in server log files: IP address, date and time of the request, requested page, referrer URL, browser type and version, and operating system.

We process this data to deliver the website and to keep it secure and stable, for example to detect and fend off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and error-free operation of the website. The log files are deleted after [e.g. 14 days], unless a security incident requires keeping them longer for investigation. We have concluded a data processing agreement with the hosting provider under Art. 28 GDPR.

To monitor the servers and analyse errors, copies of these log files are sent to Grafana Cloud, a service of Raintank, Inc. (Grafana Labs), USA, which stores them on our behalf in its data centres in the European Union (Ireland) under a data processing agreement (Art. 28 GDPR) and deletes them within the same period. The legal basis is the same legitimate interest, Art. 6(1)(f) GDPR. As the provider is a US company, access from the USA cannot be ruled out; it is covered by the EU standard contractual clauses (Art. 46(2)(c) GDPR) in that agreement.

The connection to this website is encrypted with TLS (recognisable by “https://” in the address bar).

4. Contact form and email

When you use the contact form or write to us by email, we process your name, email address, subject and message in order to answer your enquiry. The form sends your message to our mailbox by email; it is not stored on the web server.

The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract or pre-contractual steps, and otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering the enquiries addressed to us. We delete your data once your enquiry has been fully dealt with, unless statutory retention obligations (for example under commercial or tax law) require us to keep it longer.

Our email is provided by Zoho Mail, a service of Zoho Corporation B.V., Beneluxlaan 4B, 3527 HS Utrecht, Netherlands, acting as our processor.

5. Newsletter

If you subscribe to our newsletter, we process your email address to send it to you and, if you provide it, your first name to address you personally. The legal basis is your consent under Art. 6(1)(a) GDPR, which you give by submitting the form. You can withdraw your consent at any time with effect for the future, via the unsubscribe link in every newsletter or by email to contact@scholarway.net. The lawfulness of processing before withdrawal is not affected.

Double opt-in: after you submit the form you receive an email asking you to confirm your subscription. You are only added to the newsletter once you click the confirmation link. This makes sure nobody can subscribe an address that is not theirs. If the email does not arrive, you can have it sent again, twice at most, from the page where you signed up; if you have confirmed by then and requested a PDF, we email you its link instead. To be able to prove your consent, the time of the signup and of the confirmation and the IP address used are recorded.

Newsletter service: we manage the newsletter list and send the newsletter with Zoho Campaigns, a service of Zoho Corporation B.V., Beneluxlaan 4B, 3527 HS Utrecht, Netherlands, which processes the data on our behalf under a data processing agreement (Art. 28 GDPR). Your data is stored in Zoho's data centres in the European Union. We do not track whether our newsletters are opened or which links are clicked.

Together with your signup we record which link brought you to the form: its placement, the post it appeared in, the type and theme of that content and the channel (for example a social network). This information comes from the address of the link you followed, not from your device, and involves no cookies or tracking. We use it to understand which of our content leads to subscriptions. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in evaluating the reach of our content; it is stored with your subscription and deleted with it.

Form statistics: on the pages with the newsletter form we count how many visitors see the form, start filling it in, send it and open the PDF they requested, together with the link information described above. Each count holds only the time, the step, the page and that link information. It contains no IP address, no browser details and no name or email address, and nothing is stored on your device. To count each visit once per step, the page uses a random number that exists only while the page is open. The statistics do not allow us to identify you. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in evaluating the reach of our content. We delete these counts after 24 months.

Free PDFs: on some pages you can request a PDF together with your newsletter subscription. We send you a personal link to the PDF by email: if you are subscribing for the first time, our newsletter provider sends it right after you confirm your subscription; if you are already subscribed, we send it from our own server. The link works for 30 days and only in the first browser you open it in, so that it cannot be passed on. For this, opening it stores a random identifier in a cookie in that browser, sent only to the pages of these links and kept for one year; it contains nothing else, and it is strictly necessary to provide the PDF you asked for (§ 25(2) no. 2 TDDDG). With each link we keep on our server your email address, your first name if you gave it, the PDF, the link information, when the link was created and first opened, and a fingerprint of that identifier, so that we can deliver the PDF and, if you ask for it, email a fresh link to the same address. We delete these records 30 days after the link expires, or earlier together with the copy of your signup described below. Providing the PDF you asked for is based on Art. 6(1)(b) GDPR. We also record which PDF you requested, and its personal link, with your subscription at our newsletter provider, which uses the link to send you the PDF and to see which of our content leads to subscriptions (Art. 6(1)(f) GDPR, our legitimate interest in evaluating our content); it is deleted with your subscription. If your subscription cannot be registered with our newsletter provider (for example because the address unsubscribed earlier, or the provider does not accept the address), you do not receive the PDF and we delete its link at once; we send the details of your request (email address, name, the PDF and the link information) to our own inbox so that we can follow up, and delete them once that is done (Art. 6(1)(f) GDPR).

Copy on our server: when you submit the form, we also keep your email address, your first name if you gave it, the time, the page (and the PDF) and the link information on our own server, together with whether our newsletter provider accepted the signup, its reply (for example why it refused the address), whether the PDF was sent and when you asked for the confirmation email to be sent again. We use this copy to see which signups and PDF requests were completed with a confirmed subscription, and to follow up signups our provider could not register. Only our team can see it. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in managing our newsletter and the delivery of our PDFs. We delete it once it is no longer needed for these purposes, and at the latest when you unsubscribe or ask us to delete your data; our server backups, which are kept for a limited time, may still contain it until they are replaced. This copy is kept separately from the form statistics described above and is not linked to them.

We keep your email address for as long as you are subscribed. After you unsubscribe we delete it, except that we may keep a record of your consent and withdrawal for up to three years to be able to prove that it was given (Art. 6(1)(f) GDPR in conjunction with Art. 7(1) GDPR).

6. Spam protection with Cloudflare Turnstile

To protect our forms against automated abuse we use Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. When a page with a form loads, Turnstile evaluates technical characteristics of your browser and your IP address to tell humans from bots. Turnstile does not set cookies for advertising or tracking.

The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in protecting the forms against spam and abuse; any access to information on your device is strictly necessary for this security function (§ 25(2) no. 2 TDDDG). Data may be transferred to the USA. Cloudflare is certified under the EU-US Data Privacy Framework, on the basis of which the European Commission has issued an adequacy decision (Art. 45 GDPR). More information: cloudflare.com/privacypolicy.

7. Web analytics with Umami

To understand how our website is used (for example which pages are read and where visitors come from) we use Umami, an open-source analytics tool that we run ourselves on our own server at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. No data is passed to the Umami project or to any other third party.

When you open a page, Umami records the page address, the referrer URL, your browser, operating system, device type, screen size, language and the country derived from your IP address. Umami sets no cookies and stores nothing on your device. Your IP address is not stored: it is only used, together with your browser details, to compute an anonymous identifier that changes regularly, so visits cannot be linked to you over time. The resulting statistics do not allow us to identify you.

On the pages that preview our search, Umami also counts clicks on some of its buttons (opening a result, trying a new search, registering), together with the page and the details above. What you type in the search box is not recorded.

The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in measuring the reach of our website and improving its content. Since no information is stored on or read from your device beyond what is needed to display the page, no consent under § 25 TDDDG is required. You may object at any time (see below), for example by email, or by blocking the script in your browser.

8. Your rights

Regarding your personal data, you have the right to:

• access (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdraw any consent you have given, with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): where we process your data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

To exercise these rights, write to contact@scholarway.net. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence or place of work. The authority responsible for us is: Úřad pro ochranu osobních údajů (Office for Personal Data Protection), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic.

9. No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR. Providing your data is neither legally nor contractually required; without it we simply cannot answer your enquiry or send you the newsletter.