General Data Privacy Policy (GDPP)

The English version of the Privacy Policy is provided for the convenience of users. In the case of discrepancies between the German version and English version, the German version takes precedence.

I. General

The following privacy policy informs you about which personal data Expatrio Global Services GmbH ("we" or "Expatrio") process in the course of your use of our website and our web app at www.expatrio.com (the "Website") as well as our mobile app and your use of other means of communication (e.g. email, chat, phone, fax, etc.) to contact us. We will inform you about the respective legal basis, purpose and manner in which we process your personal data. In addition, we will inform you about your existing rights in this context and the duration of storage. We ask you to read the following carefully.

Personal data is any data by which you are personally identified or can be identified. This includes, for example, the data required for registration on the website, such as your name, address or telephone number, but also an online identifier.

II. responsible person

The controller pursuant to Art. 4 No. 7 GDPR for the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data. In the present case this is the

Expatrio Global Services GmbH

Linienstrasse 156-157

10115 Berlin

Germany

service@expatrio.com

+49 30 255 574 15

To exercise your rights and/or to obtain more detailed information about them, please contact us using the email below:

datenschutz@expatrio.com
TÜV SÜD Akademie GmbH
Westendstraße 160
80339 München 

If you have any questions, comments or requests regarding the processing of your personal data, please also contact us at the contact details provided.

III. Processing purposes and legal bases of the processing of data in detail

1. server log files when calling the website

Every time you visit our website, your browser automatically sends certain information to our website's server. This information is automatically collected each time you visit our website and is automatically stored in so-called "server log files" or on "log files". These are:

• the IP address of your computer,
• if applicable, the operating system of your computer,
• the type of browser you use (Firefox, Google Chrome, etc.) and its version,
• the request of your browser,
• the time of this request,
• the status of the request,
• the amount of data transferred in the context of this request,
• the date and time of access,
• the URL of the website from which you have accessed our website (so-called referrer URL),
• the URL of the website you access through our website.

The temporary storage of IP addresses by the system is necessary to enable delivery of the website to the user's computer. For this purpose, the IP address of the user is stored for up to 7 days. The log files are stored in order to ensure the functionality of the website: This data is processed to detect and eliminate website errors, to determine the utilization of the website or to make improvements, as well as to ensure the security of our information technology systems. These purposes also constitute our legitimate interest in data processing pursuant to Art. 6 (1) lit. f GDPR. This also represents the legal basis for data processing. This data is not merged with other data sources, nor is the data evaluated for marketing purposes.

The access data collected in the course of using our website is only stored for the period of time for which this data is required to achieve the aforementioned purposes. Your IP address is stored on our web server for a maximum of 7 days for IT security purposes.

2. Information about the processing of personal data when using the mobile app.

In addition to our website, we provide you with a mobile app that you can download to your mobile device. In the following, we provide information about the processing of personal data when using our mobile app. For the rest, we refer to the information in this privacy policy.

a. When you download the mobile app, the required information is transferred to the App Store, i.e.

• User name
• E-mail address and customer number of your account
• Download time
• Payment information and
• the individual device identification number.

In addition, the app store still independently collects various data and provides you with analysis results. We have no influence on this data processing and are not responsible for it. We process the data only insofar as it is necessary for downloading the mobile app to your mobile device.

b. When you use the mobile app, we process the personal data described below to enable you to use the functions comfortably. If you want to use our mobile app, we process the following data, which are technically necessary for us to offer you the functions of our mobile app and to ensure stability and security, so that they must be processed by us. The legal basis for this is Art. 6 para. 1 p. 1 lit. f GDPR:

• IP address
• Date and time of the request
• Time zone difference from Greenwich Mean Time (GMT)
• Content of the request (page visited)
• Access status/HTTP status code
• Data volume transferred in each case
• previously visited page
• User agent (web view)
• Device type and operating system

c. Furthermore, in order to provide the services of the App we require

• Your device identification,
• unique number of the terminal device (IMEI = International Mobile Equipment Identity),
• unique number of the network subscriber (IMSI = International Mobile Subscriber Identity),
• Mobile number (MSISDN),
• MAC address for WLAN use,
• Name of your mobile device,
• E-mail address.

3. Cookies, local storage and related functions/technologies

We use so-called cookies on our website. These are small text files that are stored on your terminal device and save certain settings and data for exchange with our system via your browser. A cookie usually contains the name of the domain from which the cookie data was sent, information about the age of the cookie and a characteristic sequence of numbers that allows your browser to be uniquely identified when you return to the website. Cookies allow our systems to recognize the user's device and make any preferences immediately available. As soon as a user accesses the website, a cookie is transferred to the hard drive of the respective user's terminal device.

We use cookies to make our website more user-friendly. Some elements of our website require that the calling browser can be identified even after a page change. These are the following cookies:

The following data is stored and transmitted in these technically necessary cookies:

• Language settings
• Log-In Information

The user data collected through technically necessary cookies are not used to create user profiles.

In order to guide you comfortably through the application sections on the website and so that you do not have to enter personal data again in input fields once they have been filled in, we also use so-called local storage (also known as "local memory") in addition to cookies. In this process, data is stored locally in the cache of your browser so that it continues to exist and can be read even after the browser window is closed or the program is terminated. The contents of all input fields in our application sections are stored as such local data in the local storage. Third parties cannot access the data stored in local storage.

The purpose of the use of cookies and local storage is to simplify the use of our website for users. Some functions of our website cannot be offered without the use of cookies and local storage. For these, it is necessary for the browser to be recognized even after a page change or to provide information on its part. We require cookies and local storage for the following applications:

• Accept language settings;
• takeover of log-in information;
• take over the content of input fields that have already been filled in once.

The legal basis for the processing of personal data using cookies and local storage is Art. 6 (1) lit. f GDPR. In the provision of the possibility of use of the website also lies our legitimate interest in the processing of personal data under Art. 6 para. 1 lit. f GDPR.

The storage period regarding cookies varies depending on whether they are so-called session cookies or temporary cookies. Session cookies are automatically deleted after you have left our website. Temporary cookies are stored on your end device for a certain fixed period of time. 

The duration of the storage of data in the local storage depends exclusively on you or the settings of your browser.

If you do not wish cookies to be used, you can set your browser so that cookies are not accepted or only accepted with restrictions. You can also delete already stored cookies via your browser at any time. This can also be done automatically. You also have full control over the settings in your browser with regard to local data stored in local storage. Please note that you may only be able to use our website to a limited extent or not at all as soon as you deactivate cookies or delete local data.

4. Analysis tools

We use various analytics tools on our website, which are detailed below:

a. We use Google Analytics, an analysis tool of the provider Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). We use this technology to make the Internet offer more interesting for you and to optimize the functioning of our website. The following data is processed in this context:

• the IP address of your computer;
• if necessary, the operating system of your computer;
• the type of browser you use (Firefox, Google Chrome, etc.) and its version;
• the referrer URL (or linker URL) and
• the time of the request.

This service provider is based in the USA, i.e. an insecure third country, so that risks to the fundamental rights and freedoms of the data subjects may arise as a result. The transfer to these third countries takes place on the basis of the following appropriate safeguards in accordance with Chapter V of the GDPR:

• Standard contractual clauses

You can read more about this at this link: https://policies.google.com/privacy/frameworks.

The storage takes place for a period of 6 months.

c. We use Hotjar, an analysis tool of the provider Hotjar Ltd, Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St Julian's STJ 3141, Malta. With the help of Hotjar, it is possible to measure and evaluate the usage behavior on our website in the form of clicks, mouse movements, scroll heights, etc.. The information generated by the tracking code and the cookie is transmitted to the Hotjar servers in Ireland and stored there; in detail:

• IP address of your computer
• Screen size of your display device
• Device and browser type
• Geographical location limited to the indication of the state
• Preferred language

Only on our servers the following data is logged when using Hotjar:

• referring domain
• Pages visited
• Geographical location limited to the indication of the state
• Preferred language
• Date and time of access

Hotjar stores this information in a pseudonymized user profile. The information is neither used by Hotjar nor by us to identify individual users nor is it merged with other data about individual users. For more information, please see Hotjar's privacy policy at https://www.hotjar.com/legal/policies/privacy.

Data is stored for a period of 365 days for all data except surveys, feedback and highlights. The visitor data of anonymous visitors is only stored for 3 months.

d. We use Locoia, a data optimization software from Locoia GmbH based in Hamburg, for several purposes. First, as a dashboard tool, with which we can prepare internal reports. Second, to connect different systems, and third, to automate certain processes. The information processed by the software is stored on servers in Germany.

Given the function of Locoia, all customer and user information collected elsewhere may be processed by Locoia unless expressly excluded.

Locoia's privacy policy can be found at https://www.locoia.com/gdpr-data-protection-and-data-security/.

The duration of the storage of personal data by Locoia depends on the respective statutory retention periods (e.g. from commercial law and tax law). After expiry of the respective period, the corresponding data is routinely deleted. If the data is required for the fulfillment or initiation of a contract or if Locoia has a legitimate interest in its continued storage, the data will be deleted if it is no longer required for these purposes or if you have exercised your right of revocation or objection.

e. Hubspot

We use Hubspot, an analytics tool provided by Hubspot Inc. , 25 First Street, 2nd Floor, Cambridge, MA 02141, United States. Hubspot is a marketing, sales and service platform. We use Hubspot for content management, to manage contact forms, perform email marketing, social media posting and related reporting. We also use Hubspot to analyze traffic on the Expatrio website and collect various data about you and your user behavior. This allows us to learn more about the services you are interested in and contact you in a more targeted way. To provide you with a tailored advertising experience we may share some of your data collected and processed by Hubspot with third parties that provide advertising tools and functionalities. 

In this context, some data is processed, including contact information and information such as what web browser you are using, where you are coming from, what language setting you are using, date and time of your visit to Expatrio websites, and how long you spend on which page. What information is collected and processed is situation dependent. We collect data about user behavior through cookies; additional information is collected when forms are submitted. 

The data points listed here are not an exhaustive list of all the information that could be collected, but we can provide this list upon request.

The storage takes place for a period of one year.

This service provider is based in the USA,, for which the EU Commission has issued an adequacy decision stating that the United States ensures an adequate level of protection – compared to that of the EU - for personal data transferred from the EU to US companies participating in the EU-U.S. Data Privacy Framework. The transfer of your personal data to the USA is nonetheless subject to the following appropriate safeguards in accordance with Chapter V of the GDPR:

• Standard Contractual Clauses
• Additional measures such as ensuring that our customers' data is stored as far as possible within the EU and not processed in third countries.

Hubspot will retain all Customer Data, including Personal Data, until the termination or expiration of the Subscription Service to Expatrio. At that time, Hubspot will delete or return the data in accordance with the procedures set forth in their product-specific terms. This will not apply if Hubspot is required by applicable law to retain some or all Customer Data or if Hubspot has archived Customer Data on back-up systems; such data will be securely isolated and protected from any further processing and deleted in accordance with Hubspot's deletion procedures.

f. We use Facebook Pixel, an analytics tool from Meta Platforms Inc. , 1601 Willow Road, Menlo Park, CA 94025 United States. We use Facebook Pixel for retargeting and lead generation through interest-based targeting. The information generated by the Facebook Pixel is transmitted to servers in the EU and the USA and stored there; in detail:

• Name
• Email address
• Information visible in the http header, such as IP address, web browser and location of the page.
• The other information that is collected depends on the individual campaign. Questions are often asked such as "When are you planning to come to Germany?" or "What is your GPA?"

This service provider is based in the USA, i.e. an insecure third country, so that risks to the fundamental rights and freedoms of the data subjects may arise as a result. The transfer to these third countries takes place on the basis of the following appropriate safeguards in accordance with Chapter V of the GDPR:

Standard Contractual Clauses. Further information can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum.

Meta Platforms stores data only as long as it is necessary for the purposes for which it was collected.

g. We use Smartlook, an analytics tool from Smartlook.com s.r.o.. , Šumavská 524/31, 602 00 Brno, Czech Republic, to improve your mobile app experience. Through Smartlook, we can track and record customer behavior and movements in the Expatrio Mobile App. We use Smartlook for the purpose of seeing which elements are not working properly, if there are places where customers get stuck, and most importantly, to ensure that you can navigate smoothly through the app. The information generated by Smartlook is transmitted to and stored on servers in the European Union; specifically:

• Location (country) of the mobile app session
• Date and time of the mobile app session
• Mobile device details such as screen size and operating system
• Record your activities in the app

For the mobile app, Smartlook collects the following additional data:

• Device name
• Time zone
• a log of previous visits

h. The processing of your personal data within the scope of the presented analytics tools is in each case based on your explicit consent pursuant to Art. 6 para. 1 lit. a GDPR or in some cases based on our legitimate interest to continuously develop and improve our services pursuant to Art. 6, par. 1, lit. f GDPR. You can revoke your respective consent at any time by changing your browser and/or cookie settings or by sending an e-mail to service@expatrio.com with effect for the future. Such a revocation has no effect on processing carried out before the revocation. Additionally, you can object against the processing of your personal data based on our legitimate interest by sending an e-mail to service@expatrio.com with effect for the future. Your objection will have no effect on processing carried out before the objection. 

5. Partner programs

We also use various tools that allow us to attribute visits and recommendations by partners. Specifically, we use for this purpose:

• FinanceAds, a so-called affiliate tool of financeAds International GmbH, Hardenbergstrasse 32, 10623 - Berlin, further information can be found in the privacy policy of FinanceAds at https://www.financeads.com/privacy-policy/.
• Awin, a so-called affiliate tool of AWIN AG, Landsberger Allee 104 BC, 10249 Berlin, for further information please refer to Awin's privacy policy at https://www.awin.com/de/datenschutzerklarung.
• Paperform, an online form builder and creation application of Paperform, Law Squared Level 19, 114 William Street Melbourne VIC 3000 Australia, further information can be found in the privacy policy of https://paperform.co/privacy/
  
  

FinanceAds acts as an order processor for us. To fulfill this task, the tool uses cookies and processes the following personal data:

• Address data
• Company details (of the publisher, if applicable also of the user)
• Employer data
• Income data
• Communication data (e.g. telephone, e-mail)
• Contact details of the client's employees and service providers concerned, name, address and e-mail address
• Account data
• Usage data and profiles from web tracking (e.g. in the web analytics system of the
• Contractor recorded usage data, in particular IP addresses of users).
• Personal master data
• Product specifications (e.g. running times, vehicle data, ...)
• Response data from advertisers
• Technical data (e.g. IDs for campaigns, tracking, allocation on user/product level)
• Contract billing and payment data Planning and control data Information data (from third parties, e.g. credit agencies, or from public directories)
• Contract and contact data of customers and prospective customers, name, address, e-mail address, telephone number, date of birth, delivery address, meter number,
• Information on the order status, as well as payment-related data of the contractor's customers
• Contract master data (contractual relationship, product or contractual interest)
• Customer history

Awin acts as an order processor for us. To fulfill this task, the tool uses cookies and processes the following personal data:

The data Awin uses for tracking is pseudonymous, non-sensitive, largely technical, and not related to behavior or the prediction or evaluation of consumer interests or personalities.

For example, a tracking cookie would collect the following data:

• Cookie date
• Cookie expiration date
• IP address (shortened)
• IP hash
• GeoIP
• Advertiser ID
• PublisherID
• BannerID
• Group ID
• Product ID
• Click/Network Reference
• Referrer
• Overwritten Publisher ID
• Platform

The processing of your personal data in the context of the use of the explained partner programs is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time by changing your settings or by sending an email to privacy@expatrio.com with effect for the future. Such a revocation has no effect on processing carried out before the revocation.

FinanceAds retains data only as long as it is needed for their legitimate interests and you consent to it. FinanceAds performs data routine checks to remove data that FinanceAds no longer has a legitimate interest in maintaining.

Awin stores data for a period of 36 months, unless otherwise stated in their policies and permitted by law. More information here: https://www.awin.com/de/dsgvo.

Paperform acts as an order processor for us for all the data submitted by applicants to the Expatrio Scholarship. To fulfill this task, the tool processes the following personal data:

• Personal information submitted by Scholarship applicants via the application form – name, email any other information you directly provide
• Videos submitted by Scholarship applicants via the application form
• Information obtained automatically when using Paperform’s services – activity information about your performance when visiting the application form webpage; equipment information about the devices you use,  including your device or computer operating system, IP address, browser type, and browser language.
• Location Information about your device, including GPS location, for purposes of helping us understand how the Services and functionality are being used and to deliver more relevant advertising. If you do not want to share your location, you can disable location sharing in the settings on your device.
• Cookies, Pixel Tags/Web Beacons, and other technologies. Cookies, pixel tags, web beacons, clear GIFs, JavaScript, entity tags, HTML5 local storage, resettable device identifiers, or other similar technologies.
• Demographic statistical, or other aggregate information that is about you, but individually does not identify you.

The processing of your personal data in the context of the use of the explained partner programs is based on your consent to participate in the Expatrio Scholarship pursuant to Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time by changing your settings or by sending an email to privacy@expatrio.com with effect for the future. Such a revocation has no effect on processing carried out before the revocation.

 Paperform retains data only as long as it is needed for them to manage their relationship with you unless a longer period is required by law. Paperform retains data in accordance with their record retention policies and any limitation periods and records retention obligations that are imposed by applicable law.

6. Contact form

If you send us inquiries via the contact form, your message/message including the contact data you provided there will be stored and processed accordingly for the purpose of processing and answering the inquiry as well as for the case of follow-up questions. We do not pass on this data to third parties unless this is necessary in the context of processing and answering your contact request or you have given us your corresponding consent.

If you contact us within the framework of an existing contractual relationship or contact us in advance for information about our range of services or our other services, the data and information you provide will be processed for the purpose of processing and responding to your contact request in accordance with Art. 6 (1) sentence 1 lit. b GDPR. In addition, the processing is carried out to protect our legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR appropriate response to customer or contact requests.

We use the Zendesk customer support platform from Zendesk Inc, 1019 Market Street, San Francisco, CA 94103, USA. For more information, please see the Zendesk homepage, in particular their privacy policy at https://www.zendesk.de/company/customers-partners/privacy-policy/.

We use the customer management platform Hubspot from Hubspot Inc, 25 First St 2nd Floor, Cambridge, MA, USA. For more information, please see Zendesk's homepage, in particular their privacy policy at https://legal.hubspot.com/de/privacy-policy.

Zendesk and Hubspot process the data on our behalf as processors according to Art. 28 GDPR. 

Since both companies are each based in third countries, it cannot be ruled out that personal data will be transferred to third countries where there is no adequate level of data protection, so that there is a risk to the protection of personal data. To ensure an adequate level of data protection, the transfer to these third countries takes place on the basis of the following data protection guarantees pursuant to Chapter V of the GDPR:

Zendesk has Binding Corporate Rules in accordance with Art. 47 GDPR in place.

Hubspot processes data in accordance with standard contractual clauses.

The personal data processed here are in detail the following:

• First name, last name
• E-mail address
• Subject
• Message content (free text field)
• Topic (selection from a drop-down list)

At the time of sending the message, the following data is also stored:

• the IP address of your computer and
• Date and time of contact.

The other personal data processed during the submission process are used to prevent misuse of the contact form and to ensure the security of our information technology systems. This data is deleted after 7 days at the latest.

In addition to using the contact form on our website, you also have the option of writing to us via the e-mail addresses provided for this purpose, whereby your personal data transmitted with the e-mail will be stored.

In any case, the transmitted data will be used exclusively for the processing of the establishment of communication, and your data will not be disclosed to third parties.

The data you enter in the contact form remains with us until the purpose for the data processing no longer applies. This is usually the case after the processing of your request has been completed. Mandatory legal provisions, in particular retention periods, remain unaffected.

7. Newsletter

You can register on our website to receive our newsletter. For this purpose, we use a so-called double-opt-in procedure. After providing your e-mail address, we will send you a link to it, which you can use to confirm your registration. If you do not wish to do so, your registration will be deleted. After confirmation, we store your e-mail address until you unsubscribe from the newsletter. The storage is only for the purpose of sending the newsletter. The legal basis is Art. 6 para. 1 lit. a) GDPR.

To prevent misuse, we save the access time when you register and confirm. The only mandatory information for registration is your e-mail address and name. We do not require any further data from you.

You can revoke your consent to receive the newsletter at any time by clicking on the link contained in each newsletter or via our contact form with effect for the future.

8. Registration

On our website, we offer you the opportunity to register by providing personal data. You enter your data in an input mask, whereupon they are transmitted to us and stored. The following data is collected as mandatory information during the registration process:

• First name and
• E-mail address
• Date of birth
• Country of residence

In addition, you have the option to make the following optional specifications:

• Are you already in Germany? (yes/no)
• What will you do in Germany? (Choice from drop-down list)

The following data is also stored at the time of registration:

• the IP address of your computer
• Date and time of registration
• Consent

The registration on the website serves the fulfillment of a contract to which you are a party or the implementation of pre-contractual measures, so that the legal basis for the processing of the data is Art. 6 para. 1 lit. b GDPR. Registration is necessary for the performance of a contract with you and for the implementation of pre-contractual measures.

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. This is the case insofar as the data is no longer required for the performance of the contract, for example when your user account is deleted.  Even after the conclusion of the contract, there may be a need to store your personal data in order to comply with contractual or legal obligations.

As a user, you basically have the option to delete your user account at any time. You can have the data stored about you changed at any time. To delete your account or change your data, you can always contact our office in Germany at the address Linienstraße 156-157, 10115 Berlin or contact our customer service at service@expatrio.com and the telephone number +49 30 959990770. However, if the data is still required for the performance of a contract or for the implementation of pre-contractual measures, early deletion of the data is only possible insofar as contractual or legal obligations do not prevent deletion.

9. Study counseling

After registering on our website, you have the option of making use of our service within the scope of study counseling. For this purpose, we process the following data in addition to the registration data:

• University to which you would like to apply
• Study program for which you would like to apply
• What degree you would like to get
• Date of the beginning of the study
• Grades (GPA)
• Letter of motivation
• CV
• Study certificates (school and university diploma)
• Language certificates (EN or DE)
• Special requirements for specific majors (art portfolio, video portfolio).

The processing of this additional data serves the fulfillment of a contract to which you are a party or the implementation of pre-contractual measures, so that the legal basis for the processing of the data is Art. 6 (1) lit. b GDPR.   The processing is necessary for the performance of a contract with you and for the implementation of pre-contractual measures.

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. This is the case insofar as the data is no longer required for the performance of the contract, for example when your user account is deleted.  Deletion can also take place upon request by the user, unless the exceptions of Art. 17 (3) GDPR apply. In this case, the data will be blocked. Even after termination of the contract, there may be a need to store your personal data in order to comply with contractual or legal obligations.

IV. Mediation by Expatrio and services of our cooperation partners

Through our website and other means of communication, we provide you with services that are offered by our cooperation partners and with whom you directly conclude contractual relationships. In connection with the preparation, conclusion and performance of contracts for such services, we act as an interface between you and the respective cooperation partners, who are data controllers under data protection law, and forward personal data to them in this context. The legal basis for our processing of your personal data is Art. 6 para. 1 lit. b GDPR (fulfillment of a contract to which you are a party or the implementation of pre-contractual measures). 

Details about our role in the mediation of services between our users and our cooperation partners can be found in our GTC, which are always available in the current version on our website (https://www.expatrio.com/general-terms-and-conditions). We have no influence on the data processing by these providers.

The data will be deleted as soon as they are no longer required to achieve the respective purpose of their collection. This is the case insofar as the data is no longer required for the performance of the contract, for example when your user account is deleted.  Deletion can also take place upon request by the user, unless the exceptions of Art. 17 (3) GDPR apply. In this case, the data will be blocked. Even after termination of the contract, there may be a need to store your personal data in order to comply with contractual or legal obligations. With regard to deletion by the providers, please contact the respective providers using the contact details below. These are data controllers with regard to your data. We have no influence on the deletion by them.

Specifically, our cooperation partners and the services they provide are as follows:

1. Creation and management of blocked accounts

Blocked accounts are set up and administered by AION Bank SA German Branch, Basler Straße 10, 60329, Frankfurt am Main (https://aion.eu/be-en/privacy-policy) or MANGOPAY S. A. , 2 Avenue Amélie, L-1125 Luxembourg (https://www.mangopay.com/privacy/) . The collection of data on the website serves the mediation of the contract by us on the creation and management of a blocked account and the creation and management of a blocked account by the provider, i.e. the fulfillment of a contract to which you are a party or the implementation of pre-contractual measures, so that the legal basis for the processing of the data is in each case Art. 6 para. 1 lit. b GDPR. The information is required for the performance of a contract with you and for the implementation of pre-contractual measures.

For the service to be provided by us in connection with the creation and management of a blocked account, we ask our users in particular for the data listed below and forward it to the provider for the conclusion and execution of the related contracts. The data is also used to create an Expatrio customer account for the users and to offer other relevant products to the users. The data processed by us and the provider in this process (mandatory data) is the following:

• Data on the reason for stay
• Belonging to an age group
• monthly blocking amount
• Additional basic amount, if applicable
• Information about the length of stay
• Children details
• Salutation
• First name, last name and maiden name
• Phone number
• Date, country and place of birth
• E-mail address
• Address
• Details of studies (university, place of study, course of study, start date)
• Estimated date of arrival
• Nationality
• Country of departure (last stay before entering Germany)
• Details of previous insurance
• Passport details (passport number and photo)

2. Current account

Current accounts are set up and managed by Vivid, Monese, Commerzbank, ING, Tomorrow or other providers. Expatrio does not process any personal data in this regard, but merely forwards the users to the respective provider. For the processing of personal data, please contact the respective provider.

3. Statutory health insurance

The provision of statutory health insurance services is carried out by Techniker Krankenkasse, Bramfelder Straße 140, 22305 Hamburg (https://www.tk.de/techniker/unternehmensseiten/datenschutz-2019572). The collection of the data on the website serves the mediation of the contract by us on the establishment and administration of a statutory health insurance and the establishment and administration of a statutory health insurance by the provider, i.e. the fulfillment of a contract to which you are a party or the implementation of pre-contractual measures, so that the legal basis for the processing of the data is in each case Art. 6 (1) lit. b GDPR. The information is required for the fulfillment of a contract with you and for the implementation of pre-contractual measures.

For the service to be provided by us in connection with the establishment and administration of a statutory health insurance, we ask our users in particular for the data listed below and forward it to the provider for the conclusion and execution of the related contracts.  The data is also used to create an Expatrio customer account for the users and to offer other relevant products to the users. The data processed by us and the provider in this process (mandatory data) are the following:

• Data on the reason for stay
• Belonging to an age group
• Children details
• Salutation
• First name, last name and maiden name
• Phone number
• Date, country and place of birth
• E-mail address
• Address
• Details of studies (university, place of study, course of study, start date)
• Estimated date of arrival
• Nationality
• Country of departure (last stay before entering Germany)
• Details of previous insurance
• Passport details (passport number and photo)

4. Overseas health insurance

The provision of services of an international health insurance is carried out by DR-WALTER GmbH, Eisenerzstraße 34, 53819 Neunkirchen-Seelscheid, Germany (https://www.dr-walter.com/datenschutz.html).

The collection of the data on the website serves the mediation of the contract by us on the establishment and administration of an international health insurance and the establishment and administration of the international health insurance by the provider, i.e. the fulfillment of a contract to which you are a party or the implementation of pre-contractual measures, so that the legal basis for the processing of the data is in each case Art. 6 (1) lit. b GDPR. The information is required for the performance of a contract with you and for the implementation of pre-contractual measures.

For the service to be provided by us in connection with the establishment and administration of an expatriate health insurance policy, we ask our users in particular for the data listed below and forward it to the provider for the conclusion and execution of the related contracts.  The data is also used to create an Expatrio customer account for the users and to offer other relevant products to the users. The data processed by us and the provider in this process (mandatory data) are the following:

• Data on the reason for stay
• Belonging to an age group
• Children details
• Salutation
• First name, last name and maiden name
• Phone number
• Date, country and place of birth
• E-mail address
• Address
• Details of studies (university, place of study, course of study, start date)
• Estimated date of arrival
• Nationality
• Country of departure (last stay before entering Germany)
• Details of previous insurance
• Passport details (passport number and photo)

5. Liability insurance

The provision of services of a liability insurance is carried out by Getsafe, Adam Riese, Lemonade or other providers. Expatrio does not process any personal data in this regard, but merely forwards the users to the respective provider.  For the processing of personal data, please contact the respective provider.

6. Issue of International Student Card

An International Student Card is issued by rds Reisedienst Deutscher Studentenschaften GmbH, Grindelallee 41, 20146 Hamburg, Germany (https://www.isic.de/de/hinweise/datenschutzerklaerung/). The collection of data on the website serves to mediate the contract by us for the issuance of an International Student Card and the issuance of an International Student Card by the provider, i.e. the fulfillment of a contract to which you are a party, or the implementation of pre-contractual measures, so that the legal basis for the processing of the data in each case is Art. 6 (1) lit. b GDPR. The information is required for the performance of a contract with you and for the implementation of pre-contractual measures.

For the service to be provided by us in connection with the issuance of an International Student ID Card, we additionally request from our users in particular the data listed below and forward them to the provider for the conclusion and execution of the related contracts. The data processed by us and the provider (mandatory data) are the following:

• Name
• City
• Postal code
• E-mail address
• Educational institution
• Date of birth

7. Online language course offers

The implementation of online language course offers is carried out by Chatterbug Inc, 2517 Mission St #11, San Francisco, CA 94110, USA (https://chatterbug.com/en/legal/privacychatterbug). The collection of data on the website serves, on the one hand, depending on the user's choice, the mediation of the implementation of online language course offers and the implementation of online language course offers by the provider, i.e. the fulfillment of a contract to which you are a party, or the implementation of pre-contractual measures, so that the legal basis for the processing of the data in each case is Art. 6 (1) lit. b GDPR. The information is required for the fulfillment of a contract with you and for the implementation of pre-contractual measures.

For the service to be provided by us in connection with the implementation of online language course offerings, we additionally request from our users, in particular, the data listed below and forward it to the provider for the conclusion and implementation of the related contracts. The data is also used to create an Expatrio customer account for users and to offer users other relevant products. The data processed by us and the provider in this process (mandatory data) are the following:

• Username
• E-mail address
• Password
• Profile language
• Languages you would like to learn

Since the provider is based in a third country, it cannot be ruled out that personal data will be transferred to third countries where there is no adequate level of data protection, so that there is a risk to the protection of personal data. To ensure an adequate level of data protection, the transfer to these third countries takes place on the basis of the following data protection guarantees in accordance with Chapter V of the GDPR:

• the data transfer is based on the user's consent.

8. International payment transactions

The provision of international payment transaction services is carried out by Cohort Solutions Pty Ltd (Cohort Go), P.O. Box 1288, Fortitude Valley, QLD, 4006, Australia (https://cohortgo.com/en/privacy-policy).

The collection of the data on the website serves the mediation of the contract by us for the provision of international payments by the provider, i.e. the fulfillment of a contract to which you are a party, or the implementation of pre-contractual measures, so that the legal basis for the processing of the data is in each case Art. 6 para. 1 lit. b GDPR. The information is required for the performance of a contract with you and for the implementation of pre-contractual measures.

For the service to be provided by us in connection with the provision of international payment transactions, we ask our users in particular for the data listed below and forward it to the provider for the conclusion and execution of the related contracts. The data is also used to create an Expatrio customer account for the users and to offer other relevant products to the users. The data processed by us and the provider in this process (mandatory data) are the following:

For credit card payments:

• Name, as shown on the credit card
• Credit card number
• Expiry date
• CVV

For bank transfers:

• Name on account
• IBAN
• BIC

Since the provider is based in a third country, it cannot be ruled out that personal data will be transferred to third countries where there is no adequate level of data protection, so that there is a risk to the protection of personal data. To ensure an adequate level of data protection, the transfer to these third countries takes place on the basis of the following data protection guarantees in accordance with Chapter V of the GDPR:

• Cohort Go uses a customized approach, including standard contractual clauses.

9. Accommodation

The provision of services in connection with housing is carried out by Housing Anywhere or other providers. Expatrio does not process any personal data in this regard, but merely forwards users to the respective provider. For the processing of personal data, please contact the respective provider. 

10. Jobs

The provision of services in connection with jobs is carried out by Stepstone or other providers. Expatrio does not process any personal data in this regard, but merely forwards the users to the respective provider. For the processing of personal data, please contact the respective provider.

V. Plausibility checks for authorities

At https://www.expatrio.com/products/authorities, authorities have the option of retrieving the following information by entering a UserID and the associated date of birth in order to carry out plausibility checks:

• last name;
• shortened number of the passport and date of issue;
• existing blocked account balance;
• required blocked account amount;
• monthly blocked account amount;
• additional basic amount;
• blocking period;
• health insurers;
• insurance start date.

To prevent misuse, the data is output together with the IP address of the retrieving computer and a time stamp.

The purpose for disclosing data to authorities is that we meet the legitimate interest of the authority for information, Art. 6 para. 1 lit. c GDPR. The data is stored as long as it is necessary for the provision of the purpose.

VI. Use of service providers by Expatrio

1. We process users' personal data for the purpose of providing our services and for the purpose of reading passport data in connection with their user accounts and interactions with us. For this purpose, we process the following personal data:

• Arrival date
• Visa start date
• Passport number
• Date of issue of the passport
• Date on which the validity of the passport expires
• Authority that issued the passport
• Authority processing your German visa application
• Picture from your passport

The legal basis for the processing of this personal data by us is Art. 6 para. 1 lit. b) GDPR.

Expatrio uses service providers to provide the services. They act for us as processors according to Art. 28 GDPR and process the data exclusively to support the services of Expatrio in reading passport data. These service providers are the following:

• Quondo Technology GmbH, Hardenbergstraße 27, 10623 Berlin, Germany to read passport data using optical character recognition (https://qundo.de/).

2. Hosting

We use the storage service Amazon Web Services Inc, 410 Terry Avenue North, Seattle WA 98109, USA ("AWS"). In this context, information is transferred to servers in the Frankfurt am Main region and stored there. AWS acts as a processor for us in accordance with Art. 28 GDPR. Since the company is based in the USA, data is transferred to a third country in which an adequate level of data protection is not ensured. The data transfer to the USA is based on the EU standard contractual clauses, as well as additional measures regarding data protection. Details can be found here: https://aws.amazon.com/de/blogs/security/aws-gdpr-data-processing-addendum/.

For more information, please see AWS's privacy policy: https://aws.amazon.com/de/privacy/?nc1=f_pr. 

The aforementioned processing of your data serves the purpose of providing the technical infrastructure necessary to offer our services with the help of the storage service.

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected.

3. Trustpilot

As part of the use of our services, we may ask our users to submit a rating with regard to our services on the online portal Trustpilot, which is operated by Trustpilot A/S, Pilestraede 58, 5th floor, 1112 Copenhagen, Denmark. For this purpose, users receive an e-mail with a corresponding link to the Trustpilot page following the use of one of our services. Please refer to Trustpilot's privacy policy at https://de.legal.trustpilot.com/end-user-privacy-terms and the possibility provided therein for us to display user reviews submitted and published in relation to our services on our website.

VII. Social media presence

We are present on various social media platforms, which are presented in detail below. We use our social media presences to provide information about our range of services and, to a limited extent, to communicate with (potential) users. When you visit these presences, we are jointly responsible with the operator for data processing. Nevertheless, we have only partial influence on the corresponding data processing operations. personal data that you publish on social media platforms may be used for advertising purposes and to make contact.

1. Facebook

We have a fan page on facebook, which is operated by Facebook Inc., 1 Hacker Way, Menlo Park, California 94025, USA. Please also note the privacy policy of Facebook. The processing of data by Facebook during interactions with the Facebook page, information on the legal basis and purposes of the processing of personal data, as well as information on data deletion and storage duration at Facebook are available here: https://de-de.facebook.com/policy.php.

Expatrio and Facebook are joint controllers pursuant to Art. 26 (1) GDPR, so the agreement concluded between Expatrio and Facebook, which can be accessed at the following link, applies.

https://www.facebook.com/legal/terms/page_controller_addendum

Facebook's contact information is:

1 Hacker Way

Menlo Park, California 94025, USA

Contact details of the Facebook data protection officer:

Meta Platforms Ireland Limited

4 Grand Canal Square

Grand Canal Harbour

Dublin 2, Ireland

The data protection supervisory authority for Facebook is:

Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, D02 RD28
Ireland Online form: https://forms.dataprotection.ie/contact
https://www.dataprotection.ie/

To assert data subject rights against Facebook, users follow this link: https://www.facebook.com/help/contact/540977946302970

Expatrio processes the following personal data of users during user interactions with the Facebook page:

• public profile information of the user;
• for posts, personal data specified therein;
• in the case of comments, personal data specified therein;
• when contacting Expatrio via Facebook messages, personal data provided therein;
• further user data is processed via Facebook Insights (analysis services for use and interaction with Facebook pages). Facebook does not provide Expatrio with any personal data. Expatrio only receives numerical evaluations from Facebook on the use and interaction of users with the Facebook page. Further information about the processing of insights data during interactions with the Facebook page can be found here: https://www.facebook.com/legal/terms/page_controller_addendum

We process users' personal data for the purpose of informing users that they should send their requests directly to our support team. After that, we delete any personal data, as well as comments, posts and messages from the Facebook platform.

We do not have any access to the personal data processed by Facebook in the context of Insights, but only to such data in the context of the aggregated Page Insights. These are the following evaluations, each in a specific time period:

• New followers
• Range from one post
• Post engagement
• Engagement rate

Further statistical data of the members and visitors of Facebook are processed. Facebook does not provide us with any other personal data. We only receive numerical evaluations from Facebook on the use and interaction of users with the Facebook page.

Facebook complies with all obligations under the GDPR with regard to the processing of Insights data. We do not make any decisions regarding the processing of Insights data and all other information resulting from Art. 13 GDPR. These are only provided by Facebook. Information on the legal basis and purposes of the processing of personal data by Facebook as well as the essence of the Insights supplement can be found here:

https://www.facebook.com/legal/terms/page_controller_addendum

2. Twitter

The following information applies to data processing in connection with the use of the Expatrio Twitter page available at https://mobile.twitter.com/expatrio_de/ (hereinafter the Twitter page).

In addition to this information, please also note the privacy policy of Twitter. In particular, information about the processing of data by Twitter during interactions with the Twitter site, information about the legal basis and purposes of the processing of personal data, as well as information about data deletion and storage duration at Twitter are available here:

https://twitter.com/de/privacy

Twitter complies with all obligations under the GDPR with regard to the processing of Analytics data. We do not make any decisions regarding the processing of Analytics data and all other information resulting from Art. 13 GDPR. These are only provided by Twitter Analytics.

Twitter's contact information is:

Twitter International Company
One Cumberland Place
Fenian Street
Dublin 2
D02 AX07
Ireland

Contact details of the data protection officer of Twitter International Company
https://twitter.ethicspointvp.com/custom/twitter/forms/data/form_data.asp

The data protection supervisory authority for Twitter is:

Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, D02 RD28
Ireland

+353 578 684 800
+353 761 104 800

Online form: https://forms.dataprotection.ie/contact
https://www.dataprotection.ie/

To assert data subject rights against Twitter, users follow this link:
https://twitter.ethicspointvp.com/custom/twitter/forms/data/form_data.asp

Expatrio processes the following personal data of users during user interactions with the Twitter page:

• public profile information of the user;
• in the case of tweets and retweets, personal data specified therein;
• in case of replies to tweets, personal data specified therein;
• when marking people in photos;
• location Information;
• Interactions with links;
• Cookie data;
• Log data;
• Data from advertisers and other advertising partners;
• Developer data;
• Data from other third parties and affiliates;

via Twitter Analytics (analysis services for the use and interaction with Twitter pages), further statistical data of the users are processed by Twitter. Twitter does not provide Expatrio with any personal data. We only receive numerical evaluations from Twitter on the use and interaction of users with the Twitter page.

We process users' personal data to protect our legitimate interests pursuant to Art. 6 (1) lit. f GDPR. These are the following purposes:

• Evaluation of the analyses and statistics of the Twitter page created and provided by Twitter with regard to the interaction by users with the Twitter page.
• Communication and interaction via the Twitter page opened by the users.

In doing so, we do not have access to the personal data processed by Twitter as part of Analytics.

3. Instagram

The following information applies to data processing in connection with the use of the Expatrio Instagram page available at https://www.instagram.com/expatrio/ (hereinafter the Instagram page).

In addition to this information, please also note the privacy policy of Instagram. In particular, information about the processing of data by Instagram during interactions with the Instagram page, information about the legal basis and purposes of the processing of personal data, as well as information about data deletion and storage duration at Instagram are available here:

https://help.instagram.com/519522125107875

Instagram complies with all obligations under the GDPR with respect to the processing of Analytics Data. We do not make any decisions regarding the processing of Analytics data and all other information resulting from Art. 13 GDPR. These are only provided by Instagram Analytics.

Instagram contact information is:

Instagram Inc.

1601 Willow Road

Menlo Park

CA, 94025

USA

Contact details of Instagram's data protection officer:

Meta Platforms Ireland Ltd.

4 Grand Canal Square

Grand Canal Harbour

Dublin 2 Ireland

The data protection supervisory authority for Instagram is:

Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, D02 RD28
Ireland
Online form: https://forms.dataprotection.ie/contact
https://www.dataprotection.ie/

To assert data subject rights against Instagram, users follow this link: https://www.facebook.com/help/contact/540977946302970

Expatrio processes the following personal data of users during user interactions with the Instagram page:

• public profile information of the user;
• for posts, personal data specified therein;
• when replying to posts, personal data specified therein;
• when marking people in photos;
• App, browser, and device information;

Information from partners, providers and third parties; via Instagram Analytics (analytics services for usage and interaction with Instagram pages), further statistical data of Instagram users are processed. On the part of Instagram, Expatrio is not provided with any personal data. We only receive numerical evaluations from Instagram on the use and interaction of users with the Instagram page.

We process users' personal data to protect our legitimate interests pursuant to Art. 6 (1) lit. f GDPR. These are the following purposes:

• Evaluation of the analytics and statistics of the Instagram page created and provided by Instagram regarding the interaction by the users with the Instagram page.
• Communication and interaction through the Instagram page opened by the users.

In doing so, we do not have access to the personal data processed by Instagram as part of Analytics.

4. LinkedIn

The following information applies to data processing in connection with the use of the Expatrio LinkedIn page available at https://de.linkedin.com/company/expatriogmbh (hereinafter the LinkedIn page).

Please also note the privacy policy of LinkedIn. The processing of data by LinkedIn during interactions with the LinkedIn site, information on the legal basis and purposes of the processing of personal data, as well as information on data deletion and storage duration at LinkedIn are available here:

https://de.linkedin.com/legal/privacy-policy

Expatrio and LinkedIn are joint controllers pursuant to Art. 26 (1) GDPR, so the agreement concluded between Expatrio and LinkedIn, which can be accessed at the following link, applies.

https://legal.linkedin.com/pages-joint-controller-addendum

LinkedIn contact information is:

LinkedIn Ireland Unlimited Company
Wilton Place
Dublin 2
Ireland

Contact details of the data protection officer of LinkedIn Ireland Unlimited Company:

https://www.linkedin.com/help/linkedin/ask/TSO-DPO

The data protection supervisory authority for LinkedIn is:

Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, D02 RD28
Ireland

+353 578 684 800
+353 761 104 800

Online form: https://forms.dataprotection.ie/contact
https://www.dataprotection.ie/

To assert data subject rights against LinkedIn, users follow this link: https://www.linkedin.com/help/linkedin/ask/TSO-DPO

Expatrio processes the following personal data of Users during User interactions with the LinkedIn Site:

• public profile information of the user;
• for posts, personal data specified therein;
• in the case of comments, personal data specified therein;
• when contacting Expatrio via LinkedIn messages, personal data provided therein;

We process users' personal data for the purpose of informing users that they should send their requests directly to our support team. After that, we delete any personal data, as well as comments, posts and messages from the LinkedIn platform.

We also process users' personal data to protect our legitimate interests (Art. 6 (1) (f) GDPR). These are the following purposes:

• Evaluation of the analyses and statistics of the LinkedIn page created and provided by LinkedIn with regard to the interaction by the users with the LinkedIn page
• Improving the LinkedIn page in terms of its usability and attractiveness, as well as carrying out marketing activities
• Communication and interaction through the LinkedIn page opened by the users.

Further statistical data of the members and visitors of LinkedIn are processed. LinkedIn does not provide us with any other personal data. We only receive numerical evaluations from LinkedIn on the use and interaction of users with the LinkedIn page.

LinkedIn complies with all obligations under the GDPR with regard to the processing of Insights data. We do not make any decisions regarding the processing of Insights data and all other information resulting from Art. 13 GDPR. These are only provided by LinkedIn. Information on the legal basis and purposes of the processing of personal data by LinkedIn as well as the essence of the Insights supplement can be found here:

• LinkedIn Privacy Policy: https://de.linkedin.com/legal/privacy-policy
• Page Insights Information: https://legal.linkedin.com/pages-joint-controller-addendum

5. Wechat

We have a profile with Tencent International Services Europe BV (here: Wechat).  Information on data protection can be found at https://www.wechat.com/en/privacy_policy.html.

The following information applies to data processing in connection with the use of the Expatrio Wechat profile available at https://mp.weixin.qq.com/s/u3ikQer3oa0kWiG8bcATLA (hereinafter the Wechat profile).

In addition to this information, please also note the privacy policy of Wechat. In particular, information about the processing of data by Wechat during interactions with the Wechat profile, information about the legal basis and purposes of the processing of personal data, as well as information about data deletion and storage duration at Wechat are available here:

For WeChat users: https://www.wechat.com/en/privacy_policy.html

For Weixin users: https://weixin.qq.com/cgi-bin/readtemplate?lang=en_US&t=weixin_agreement&s=default&cc=CN and https://weixin.qq.com/cgi-bin/readtemplate?lang=en_US&t=weixin_agreement&s=privacy&cc=CN. Weixin users are people who are logged in with a phone number with the international dialing code +86 (the prefix for mainland China). People who are logged in with a different international dialing code are WeChat users.

Wechat complies with all obligations arising from the GDPR with regard to the processing of Analytics data. We do not make any decisions regarding the processing of Analytics data and all other information resulting from Art. 13 GDPR. These are only provided by Wechat Analytics.

Wechat's contact information is:

Tencent International Services Europe BV

Amstelplein 54

1096 BC Amsterdam

Netherlands

Contact details of Wechat's data protection officer:

If you are in the European Economic Area, the UK or Switzerland: Tencent International Service Europe B.V., Buitenveldertselaan 1-5, 1082 VA, Amsterdam, the Netherlands.

If you are outside the above areas or mainland China: WeChat International Pte. Ltd, 10 Anson Road, #21-07 International Plaza, Singapore 079903.

The data protection supervisory authority for Wechat is the respective authority at the user's place of residence or workplace. In Berlin this is:

    Berlin Commissioner for Data Protection and Freedom of Information

    Friedrichstr. 219

    10969 Berlin

    Phone: 030 13889-0

    Fax: 030 2155050

    Email: mailbox@datenschutz-berlin.de.

To exercise data subject rights against Wechat, users follow this link:
dataprotection@wechat.com

Expatrio processes the following personal data of Users during interactions of the User with the Wechat profile:

• WeChat profile nickname
• Other information users share with us during the chat

We process users' personal data to protect our legitimate interests pursuant to Art. 6 (1) lit. f GDPR. These are the following purposes:

• Evaluation of the analytics and statistics of the Wechat profile created and provided by Wechat regarding the interaction by the users with the Wechat profile;
• Communication and interaction via Wechat profile opened by users.

In doing so, we do not have access to the personal data processed by Wechat in the context of analyses.

6. YouTube

The following information applies to data processing in connection with the use of the Expatrio YouTube channel available at https://www.youtube.com/channel/UCvmq2aVEDRNZ0VNLgf7y3rw (hereinafter the YouTube channel).

In addition to this information, please also note the privacy policy of YouTube. In particular, information about the social network YouTube, which is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, the processing of data by YouTube during interactions with the YouTube channel, information about the legal basis and purposes of the processing of personal data, as well as information about data deletion and storage duration at YouTube are available here:

https://policies.google.com/privacy?hl=de

YouTube complies with all obligations under the GDPR with regard to the processing of data collected by YouTube. We do not make any decisions regarding the processing of Analytics data and all other information resulting from Art. 13 of the GDPR. These are only provided by YouTube.

YouTube's contact information is:

Google Ireland Limited

Gordon House, Barrow Street

Dublin 4

Ireland

Phone: +353 1 543 1000

Fax: +353 1 686 5660

E-mail: support-germany(at)google.com

Authorized to receive service of process on behalf of Google Ireland Limited within the meaning of Section 5 (1) of the Network Enforcement Act:

Google Germany GmbH

- Legal department -

ABC Street 19

20354 Hamburg

Germany

Contact details of the data protection officer of Google Ireland Limited

https://support.google.com/policies/contact/general_privacy_form

The data protection supervisory authority for YouTube is:

Data Protection Commission

21 Fitzwilliam Square South

Dublin 2, D02 RD28

Ireland

+353 578 684 800

+353 761 104 800

Online form: https://forms.dataprotection.ie/contact

https://www.dataprotection.ie/

To assert data subject rights against YouTube, users follow this link:

https://support.google.com/policies/contact/general_privacy_form

Expatrio processes the following personal data of users during user interactions with the YouTube channel:

• public profile information of the user;
• via YouTube Analytics (analysis services for the use and interaction with YouTube channels), further statistical data of YouTube users are processed. On the part of YouTube, Expatrio is not provided with any personal data. Expatrio only receives numerical evaluations from YouTube on the use and interaction of users with the YouTube channel.

Expatrio processes users' personal data to protect its legitimate interests. These are the following purposes:

• Evaluation of the analyses and statistics of the YouTube channel created and provided by YouTube with regard to the interaction by the users with the YouTube channel.
• Communication and interaction via the YouTube channel opened by the users.

In doing so, we do not have access to the personal data processed by YouTube as part of Analytics.

We have a profile at Kakao Corp (Kakao), 242, Cheomdan-ro, Jeju-si, Jeju-do, 63309, Korea. For privacy information, please visit https://www.kakao.com/policy/privacy?lang=en.

We have a profile on vk.com. The operator is V contacts prem. 1-N, bld. 12-14, lit. A, Khersonskaya st., St. Petersburg, Russia, 191024. For privacy information, please visit https://vk.com/privacy.

We have a profile with Tencent International Services Europe BV (here: QQ), Amstelplein 54, 1096 BC Amsterdam, Netherlands.  Information on data protection can be found at https://www.imqq.com/privacy/privacy_En.html.

VIII. No disclosure of personal data

As a matter of principle, we do not disclose your personal data to third parties beyond the processing activities described, unless you have consented to the disclosure of data or we are entitled or obliged to disclose data on the basis of statutory provisions and/or official or court orders. In particular, this may involve the disclosure of information for the purposes of criminal prosecution, the prevention of danger or the enforcement of intellectual property rights.

IX. Data subject rights

You have the following rights with respect to personal data concerning you, which you may exercise against Expatrio:

• Right of access: You may request information in accordance with Art. 15 GDPR about your personal data processed by Expatrio.
• Right to rectification: if the information concerning you is not (or no longer) accurate, you can request a rectification in accordance with Art. 16 GDPR. If your data is incomplete, you can request that it be completed.
• Right to deletion: You can request the deletion of your personal data in accordance with Art. 17 GDPR. For this purpose, you can use the contact form on the website.
• Right to restriction of processing: You have the right to request restriction of your personal data in accordance with Art. 18 GDPR.
• Right to object to processing: You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data which is carried out on the basis of Article 6 (1) sentence 1 lit. e or lit. f GDPR, in accordance with Article 21 (1) GDPR. In this case, Expatrio will not further process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, furthermore, if the processing serves the assertion and exercise of or defense against legal claims (Art. 21 (1) GDPR). In addition, according to Art. 21 (2) GDPR, you have the right to object at any time to the processing of personal data concerning you for the purposes of direct marketing; this also applies to any profiling, insofar as it is related to such direct marketing. Expatrio refers to the right to object in this Privacy Policy in connection with the respective processing. For clarification: profiling is not carried out by Expatrio.
• Right to withdraw consent: insofar as consent has been given for processing, you have a right of withdrawal for the future at any time. This means that your revocation will not affect the processing of data that we have carried out between the granting of your consent and your revocation. You do not have to give reasons for your revocation. An informal notification by e-mail to datenschutz@expatrio.com is sufficient.
• Right to data portability: You have the right to receive the personal data concerning you that you have provided to us in a structured, common and machine-readable format ("data portability") as well as the right to have this data transferred to another controller if the prerequisite of Art. 20 para. 1 lit. a, b GDPR are met (Art. 20 GDPR).

You may exercise your rights by notifying the contact information listed in Section II. or by contacting the Data Protection Officer (also see Section II.).

If data subjects are of the opinion that the processing of their personal data violates data protection law, they also have the right to complain to a data protection supervisory authority of their own choice pursuant to Art. 77 GDPR. This also includes the data protection supervisory authority responsible for Expatrio:

    Berlin Commissioner for Data Protection and Freedom of Information

    Friedrichstr. 219

    10969 Berlin

    Phone: 030 13889-0

    Fax: 030 2155050

    Email: mailbox@datenschutz-berlin.de.