Privacy Policy

Cyber Valley Privacy Policy in Accordance with the GDPR

Cyber Valley GmbH takes the protection of your personal data very seriously. This Privacy Policy explains what data is being collected and how it is being used.

1. Name of the responsible entity 

Cyber Valley GmbH  
Heisenbergstraße 3  
70569 Stuttgart 

Telephone: 0711 – 689 1844  
E-Mail: contact@cyber-valley.de  

2. Data Protection Officer 

Bernd Herrig  

Technische Akademie für berufliche Bildung  
Schwäbisch Gmünd e.V.  
Lorcher Straße 119  
73529 Schwäbisch Gmünd  

Telephone: 0172 7541376  
E-Mail: bernd.herrig@technische-akademie.de  

3. What are your data protection rights?

For questions about your rights or any other matters relating to personal data, you may contact the Data Protection Officer at any time by e-mail at bernd.herrig@technische-akademie.de or by post at the responsible entity’s address given above. 

You have various rights under the General Data Protection Regulation (GDPR). In certain cases, these rights cannot or may not be exercised. If we are unable to comply with a request in a particular case, we will inform you of the reasons in writing. 

3a) Access, deletion, and correction 

You have the right, within the framework of the applicable legal provisions, to obtain free information at any time about your stored personal data, its origin and recipients, and the purpose of the data processing. Where applicable, you also have the right to request the rectification or erasure of this data. 

3b) Right to restriction of processing 

You have the right to request the restriction of the processing of your personal data. This means that your personal data will no longer be actively processed and will be retained in a restricted archive for legal reasons.

3c) Right to data portability 

You have the right to have data that we process by automated means provided to you or to a third party in a commonly used, machine-readable format. If you request the direct transfer of the data to another data controller, this will only be carried out where technically feasible. 

3d) Right to object to data collection in specific circumstances 

Where data processing is based on Article 6(1)(f) of the General Data Protection Regulation (GDPR), you have the right to object at any time to the processing of your personal data on grounds relating to your particular situation. If you object, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or unless the processing serves the establishment, exercise or defense of legal claims (objection pursuant to Article 21(1) GDPR). 

3e) Withdrawal of your consent to data processing 

You may withdraw your consent at any time. The lawfulness of any data processing carried out prior to the withdrawal of your consent shall remain unaffected by such withdrawal.

3f) Right to lodge a complaint with the competent supervisory authority 

In the event of violations of the GDPR, you have the right to lodge a complaint with a supervisory authority. The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart. 

4. Website 

When you use this website, various types of personal data are collected. Please note that data transmission over the Internet (e.g. when communicating by email) may be subject to security vulnerabilities. Complete protection of data against access by third parties is not possible. Some of your data is collected when you provide it to us. This may include, for example, data that you enter into forms on our website. Other data is collected automatically by our IT systems, or with your consent, when you visit the website. This primarily consists of technical data. This data is collected automatically as soon as you access this website. We use your data to ensure the proper functioning of the website and to provide you with our services in the best possible way.

4.1 SSL or TLS encryption 

For security reasons and to protect the transmission of confidential content, such as newsletter subscriptions or enquiries that you send to us as the website operator, this website uses SSL or TLS encryption. 

You can recognise an encrypted connection by the change in the browser’s address bar from “http://” to “https://“ and by the padlock icon in your browser’s address bar. When SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties. 

4.2 External hosting 

This website is hosted by Raidboxes GmbH, Hafenstraße 32, 48153 Münster, Germany (the hosting provider). The personal data collected on this website is stored on the hosting provider’s servers. This may include IP addresses, contact enquiries, metadata and communications data, contact details, names, website access data and other data generated through the use of a website. 

We use this hosting provider on the basis of our legitimate interest in ensuring the secure, fast and efficient provision of our online services through a professional provider (Article 6(1)(f) GDPR). The hosting provider processes your data only to the extent necessary to provide the website and exclusively on our behalf.  

4.3 Provision of the website (Server Log Files) 

Whenever you access our website, our server automatically collects and stores information in server log files, which your browser automatically transmits to us. This includes: 

  • Browser type and browser version 
  • Operating system used 
  • Referrer URL 
  • Address of the page accessed 
  • Hostname of the accessing computer 
  • Date and time of the server request 
  • IP address 

This data is not combined with data from other sources. The legal basis for the temporary storage of the data and log files is Article 6(1)(f) GDPR. The data is stored in log files to ensure that the website functions properly. In addition, we use this data to optimise the website, resolve technical issues and ensure the security of our information technology systems. These purposes also constitute our legitimate interest in processing the data under Article 6(1)(f) GDPR. 

The data is deleted as soon as it is no longer necessary to fulfil the purpose for which it was collected. Where data is collected to provide the website, this is the case when the relevant session ends. Where data is stored in log files, it is deleted after a maximum of seven days. Longer storage is possible in certain cases. In such instances, users’ IP addresses are deleted or anonymized so that the accessing client can no longer be identified.

4.4 Cookies, consent and browser storage 

Our website uses cookies and similar technologies. Cookies are small text files stored on your device. We use technically necessary cookies without obtaining your consent (Section 25(2), point 2 TDDDG). All other cookies, as well as services that access your device or transmit data to third parties, are used only with your consent (Section 25(1) TDDDG in conjunction with Article 6(1)(a) GDPR). 

Consent management 

We use the WordPress plugin Borlabs Cookie to manage your consent. The plugin runs on our own server, and no data is transmitted to its plugin provide. Your selection is stored in the “borlabs-cookie” cookie so that we do not have to ask you again each time you visit our website. To document your consent, we store a pseudonymous identifier, the date and time of consent, and the settings you have selected.

The legal basis for storing your selection is Section 25(2), point 2 TDDDG. The legal basis for documenting your consent is Article 6(1)(c) in conjunction with Article 7(1) GDPR. 

Content from third-party providers, such as YouTube or Podigee, is loaded only once you have given your consent through the banner or directly via the relevant placeholder. You can change or withdraw your consent at any time by clicking the fingerprint icon at the bottom left of the page. 

Name  Provider Purpose Storage Period  Legal Basis 
borlabs-cookie  Cyber Valley (own server) Stores your consent preferences 6 months  § 25(2) No. 2 TDDDG 
_pk_id  Matomo   (own server)  Recognition for visitor statistics (see Section 4.5) 13  months  § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR 
_pk_ses  Matomo   (own server)  Assignment of page views within a single visit (see Section 4.5) 30 minutes  § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR 
YouTube cookies  Google  See Section 5.4 See Google  § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR 

4.5 Web Analytics with Matomo 

We use the open-source web analytics service Matomo on our website. Matomo is operated exclusively on our own servers at our hosting provider (see Section 4.2). The data collected is not shared with Matomo or any other third parties. 

We use Matomo to analyze how our website is used in order to improve our services. In particular, the following data is processed: 

  • IP address in truncated form (the last two bytes are removed, e.g. 192.168.xxx.xxx) 
  • Pages accessed and the date and time of access 
  • Time spent on individual pages 
  • Referrer URL (the previously visited page) 
  • Browser type and version, operating system and screen resolution 

Matomo sets the following cookies: 

  • “_pk_id”: Used to recognize your browser on subsequent visits. Storage duration: 13 months.
  • “_pk_ses”: Used to associate page views within a single visit. Storage duration: 30 minutes.

This data is not combined with information from other sources. We do not attempt to identify you personally through this data.

Matomo is activated only if you have given your consent through the cookie banner. The legal basis for this processing is your consent pursuant to Section 25(1) TDDDG in conjunction with Article 6(1)(a) GDPR. You can withdraw your consent at any time via the fingerprint icon at the bottom left of the page (see Section 4.4). This does not affect the lawfulness of any processing carried out before consent was withdrawn. 

The raw data (individual visits and actions) is automatically deleted after 180 days. After this period, only aggregated statistics that cannot be linked to individuals are retained.

4.6 Newsletter 

You can subscribe to free newsletters on our website. When you subscribe, the provided email address is transmitted to us via the subscription form. You will then receive an email asking you to confirm your subscription (double opt-in). 

We use CleverReach, a service provided by CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany, to distribute our newsletters. The data you provide when subscribing is stored on CleverReach’s servers and processed exclusively on our behalf. We have entered into a data processing agreement with CleverReach in accordance to Article 28 GDPR. Your data is not shared with any other third parties. 

Our newsletters contain tracking features that allow us to analyze whether a newsletter has been opened, and which links have been clicked. When you open a newsletter, a small, invisible image (tracking pixel) is loaded from CleverReach’s server, and links in the newsletter are redirected through CleverReach. This records the time of opening or clicking, your IP address and technical information about your browser and email application, and associates this information with your email address. This analysis enables us to tailor the content of our newsletters more closely to the interests of our readers.

The legal basis for sending the newsletter and carrying out the analysis described above is your consent pursuant to Article 6(1)(a) GDPR. You can unsubscribe from the newsletter at any time, by clicking the unsubscribe link included in every newsletter. The lawfulness of any processing carried out prior to unsubscribing remains unaffected. Following your unsubscribe request, your email address will be deleted unless statutory retention obligations require otherwise. 

4.7 Enquiries by email or telephone 

If you contact us by email or telephone, we store and process your enquiry, including any personal data it contains (e.g. your name and the details of your enquiry), for the purpose of handling your request and addressing any follow-up questions. 

The processing of this data is based on Article 6(1)(b) GDPR if your enquiry relates to the performance of a contract or is necessary to take steps prior to entering into a contract. In all other cases, processing is based on our legitimate interest in effectively handling enquiries addressed to us pursuant to Article 6(1)(f) GDPR, or on your consent pursuant to Article 6(1)(a) GDPR, where this has been requested. 

The data you send us is retained until you request its deletion, withdraw your consent to its storage, or the purpose for which it is stored no longer applies (e.g. once your enquiry has been fully resolved). When this occurs, the data is deleted. Mandatory statutory provisions, in particular statutory retention periods, remain unaffected. 

5. Social Media 

We maintain accounts on the platforms listed below in order to provide you with information and updates about our work and services and to offer you additional ways of getting in touch with us. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in presenting our work and communicating with the public. 

If you contact us via a direct message, we generally process your username and the data you provide to the extent necessary to handle your enquiry. The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in effectively handling enquiries addressed to us. 

The platforms also provide us with statistical analyses relating to our accounts (e.g. reach, interactions with posts and number of followers). These statistics are aggregated and do not allow individual users to be identified. 

You do not need to be a member of the respective platform to view the content of our accounts. Please note that when you access these platforms, they may process data even if you do not have a user account. For this purpose, they may use cookies and similar technologies, over which we have no control. It cannot be ruled out that your data may also be processed outside the EU, particularly in the United States. According to the respective providers, they rely on the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses for such transfers. Further details can be found in the privacy policies of the respective platforms. 

5.1 LinkedIn 

LinkedIn is a social network operated by LinkedIn Inc., based in Sunnyvale, California, USA, that allows users to create personal and professional profiles. Users can maintain existing contacts and establish new ones. Companies can create profiles where they can upload photos and other company information. Other LinkedIn users can access this information, publish their own articles and share this content with others. 

The platform focuses primarily on professional exchange and discussions on specialist topics among people with similar professional interests. In addition, LinkedIn is frequently used by companies and other organisations to recruit employees and present themselves as attractive employers. The legal basis is Article 6(1)(f) GDPR (processing is necessary for the purposes of the legitimate interests pursued by the controller). Further information about LinkedIn is available at: https://about.linkedin.com/de-de?lr=1 

Further information about data protection at LinkedIn is available at: 
https://de.linkedin.com/legal/privacy-policy. You can also find further information via our LinkedIn company page. 

5.2 Instagram 

Instagram is a social media platform provided by Meta Platforms Inc., 1601 Willow Rd, Menlo Park, CA 94025, represented by Meta Platforms Ireland Limited. When you visit these pages, Meta Inc. collects, among other things, your IP address and other information stored on your device in the form of cookies. This information is used to provide us, as the operator of the pages, with statistical information about their use. Further information is available at: 
https://privacycenter.instagram.com/policy/?entry_point=ig_help_center_data_policy_redirect&_coig_consent=1 

The statistical information provided to us does not allow us to identify individual users. We use it solely to respond to our users’ interests, continually improve our online presence and maintain its quality. We collect your data through our account solely to enable communication and interaction with us. This generally includes your name, the content of your messages and comments and, where applicable, any profile information you have made publicly available. 

Your personal data is processed for the purposes described above on the basis of our legitimate interest in providing an information and communication channel pursuant to Article 6(1)(f) GDPR. If you, as a user, have given the social network your consent to data processing, Article 6(1)(a) GDPR also serves as a legal basis for the processing. 

Since the actual data processing is carried out by Meta Inc., our access to your data is limited. Only the provider has full access to your data. Consequently, only the provider can directly take and implement the appropriate measures to fulfil your rights (requests for access, requests for erasure, objections, etc.). These rights can therefore be exercised most effectively by contacting the respective provider directly: https://privacycenter.instagram.com/policy/?section_id=7-WhatIsOurLegal. We are jointly responsible with Meta Inc. for the personal data contained in the content of our account. 

Under the GDPR, Meta Inc. has primary responsibility for processing “Insights data” (Instagram’s statistics feature). Meta Inc. must therefore ensure compliance with all obligations under the GDPR relating to the processing of “Insights data”. We do not make any decisions regarding the processing of “Insights data”. All further information required under Article 13 GDPR, including the legal bases, the identity of the controller and the storage periods of cookies on users’ devices, is provided by Meta Inc. 

Related enquiries can be addressed directly to Meta Platforms Ireland Limited via the following link: 
https://privacycenter.instagram.com/policy/?section_id=13-HowToContactMeta 

5.3 Bluesky 

We maintain a publicly accessible profile on the social networking platform Bluesky. The platform is provided by Bluesky Social, PBC, Seattle, Washington, USA. 

Our presence on Bluesky serves public relations purposes, provides information about our services and events, and enables communication with interested individuals. 

When you visit our Bluesky profile or interact with our posts, personal data may be processed. This includes your username, publicly accessible profile information, comments, reactions, and the content of messages you send to us. 

Where we process personal data in connection with the management of our Bluesky profile, such processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in maintaining up-to-date public relations activities, communicating with interested individuals, and providing information about our services. 

Bluesky processes personal data independently when you use its platform. This may include IP addresses, device information, usage data, and information about interactions. Generally, we have no influence over the nature or scope of this data processing. 

The processing of personal data in the USA or other countries outside the European Union or the European Economic Area cannot be ruled out. Bluesky states that it uses appropriate data protection safeguards for such transfers to third countries. 

Further information about data processing, your data subject rights, and Bluesky’s data protection measures can be found in the provider’s Privacy Policy: 

https://bsky.social/about/support/privacy-policy

Use of Bluesky is voluntary. You can also access our information via our website without having a Bluesky account or using the platform. 

If you access Bluesky via a simple link on our website, a connection to the platform is only established when you click on the link. 

5.4 YouTube 

This website features videos from the YouTube platform, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The video platform is operated by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA, a subsidiary of Google. 

The videos are not loaded automatically. Instead, you will initially see a placeholder containing a preview image stored on our own server. A connection to YouTube’s servers is only established once you give your consent via the placeholder or the cookie banner. If you are logged in to Google or YouTube at the same time, Google may associate your visit with your account. 

We use YouTube to optimize our services and provide a better presentation of our work. When YouTube is used, the following data may be processed: IP address, contact details, data relating to your user behavior, and device information. As YouTube also processes data in the USA, among other countries, we are required to inform you of this. 

Google stores the collected data for varying periods, depending on the type of data concerned. Further information can be found at: https://policies.google.com/privacy?hl=en#inforetaining and in Section 4 of this Privacy Policy. 

The processing of data on our website (embedding and playing videos) is based on your consent pursuant to Art. 6(1)(a) GDPR. The creation and operation of our own YouTube channel is based on Art. 6(1)(f) GDPR. We have a legitimate interest in presenting our work directly on this platform. Further information is available at: https://policies.google.com/privacy?hl=en 

6. Job Applications and Job Vacancies 

We publish job vacancies on our website. Some relate to positions at our company, while others refer to opportunities at other organizations, for which the respective providers are responsible. The following information applies exclusively to applications submitted to Cyber Valley GmbH. 

We process your personal data for the purpose of conducting the recruitment process. This includes, in particular, your contact details (name, e-mail address, telephone number), your application documents, such as your CV, cover letter and references (which may contain additional information, such as your birthday and place of birth), your LinkedIn profile, where applicable, and information about how you became aware of us. 

The legal basis for processing is Art. 6(1)(b) GDPR (taking steps prior to entering into an employment relationship). Where we are legally obliged to process your data, the legal basis is Art. 6(1)(c) GDPR. Where processing is necessary for the establishment, exercise or defense of legal claims, the legal basis is Art. 6(1)(f) GDPR. If you give us your consent, for example to retain your application documents for a longer period, the legal basis is Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future. 

We use the software Personio, provided by Personio SE & Co. KG, Seidlstraße 3, 80335 Munich, Germany, to manage applications. Personio processes your data exclusively on our behalf. We have concluded a data processing agreement with Personio in accordance with Art. 28 GDPR. 

Within our company, access to your personal data is restricted to those individuals involved in the recruitment process. Your data will only be disclosed to third parties where permitted, or required by law, or where you have given your consent. 

Your application documents will be deleted no later than six months after the conclusion of the recruitment process (e.g. after notification that your application has been unsuccessful), unless longer retention is required by law or you have consented to a longer retention period. In the latter case, we will delete your data after 12 months. If an employment relationship is established, your data will be transferred to your personnel file to the extent necessary. 

7. Podcast 

We make our audio podcast available through the podcast hosting service Podigee, provided by Podigee GmbH, Revaler Straße 28, 10245 Berlin, Germany. A Podigee player is embedded on certain pages of our website. When you access one of these pages, the player is loaded from Podigee’s servers. In this process, your IP address and technical information about your device and browser are transmitted to Podigee. 

Podigee processes this data to enable podcast playback and to collect statistical information, such as the number of downloads and plays. According to Podigee, the data is anonymized or pseudonymized before storage, unless it is required for the provision of the podcasts. 

The legal basis for this processing is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and efficient provision of our podcast offering and the analysis of its usage. Further information can be found in Podigee’s Privacy Policy: https://www.podigee.com/de/about/privacy/ 

8. Events 

We organize events and programs, primarily in person and, in some cases, in a hybrid format. For registration and the organization of these events, we process the following personal data of participants: 

  • First and last name 
  • Institution or organization and business address 
  • E-mail address 
  • Photographs and videos, where applicable (see below) 

Registration for our events generally takes place via the Eventbrite or Luma platforms. For some smaller events, we also use online forms (Microsoft Forms). For hybrid events, we use Microsoft Teams to enable online participation. In this context, the following data is processed: your display name and, where you actively enable these features, audio and video data as well as chat messages. Online participation is not recorded. Microsoft Forms and Microsoft Teams are provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. We have concluded a data processing agreement with Microsoft in accordance with Art. 28 GDPR. 

Eventbrite is a service provided by Eventbrite Inc., 95 Third Street, 2nd Floor, San Francisco, CA 94103, USA. Its EU representative is Eventbrite Operations (IE) Limited, 97 South Mall, Cork, T12 XV54, Ireland. According to Eventbrite, it processes your registration data on our behalf and relies on the EU-US Data Privacy Framework and Standard Contractual Clauses for transfers to the USA. 

Luma is a service provided by Luma Labs, Inc., USA. When registering via these platforms, your data may be processed in the USA. Their respective privacy policies also apply: 

https://www.eventbrite.de/help/de/articles/460838

https://luma.com/privacy-policy

The legal basis for processing your registration data is Art. 6(1)(b) GDPR (performance of the event). 

Photographs and Videos 

Photographs and videos are sometimes taken at our events and used for public relations purposes, for example on our website, on our social media channels, and in press releases and reports. During registration, you may voluntarily give your consent to the publication of recordings in which you are identifiable (Art. 6(1)(a) GDPR). If you have not given your consent, we will not publish any recordings in which you are identifiable. You may withdraw your consent at any time with effect for the future. Your data will be deleted as soon as it is no longer required for the organization and follow-up of the event, provided that no statutory retention obligations prevent its deletion.