CODE Student Privacy Policy
1. Introduction
CODE University of Applied Sciences (“CODE”, “we”, “our”, “us”) is committed to being clear and transparent about data protection, protecting privacy and the rights of data subjects. We want to ensure that students (“you”, “your”) know what data we collect, why we collect it, and how it is processed. We also aim to be clear about data collection, storage, usage, and your rights to assure you that we would not use your data in a way you would not want or expect us to.
2. Data Controller
This privacy policy is applicable to data processing by CODE University of Applied Sciences and its legal entity:
CODE Education GmbH
Managing Director: Reimar Müller-Thum
Lohmühlenstr. 6512435 Berlin
The Data Protection Officer may be reached at dataprivacy@code.berlin or the aforementioned address.
3. Scope
This policy applies to all CODE students on the B.A. Interaction Design, B.A. Product Management and B.Sc. Software Engineering.
4. Data Collection and Processing
4.1. Why We Process Your Data
We need to collect, store and process personal data for a number of administrative and legal reasons and to ensure that both you and we can meet our contractual obligations.
As per the General Data Protection Regulation (GDPR), this also forms the legal basis under which we process your data, more specifically:
1. GDPR Art. 6, Par. 1(b): processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
2. GDPR Art. 6, Par. 1(c): processing is necessary for compliance with a legal obligation to which the controller is subject.
Additionally, data may also be processed under GDPR Art. 6, Par. 1(a): the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
Reasons for processing your data include:
1. Administering your student record from recruitment, to application, admissions, enrolment, and graduation;
2. Providing academic services, including teaching and learning, academic support, examinations, monitoring and managing academic progress, monitoring and managing academic misconduct, recording participation in teaching and learning events, and recording grades and awards of qualifications;
3. Providing student services, including issuing student ID cards carrying photographs, certificates of enrolment and exmatriculation, transcripts of records, managing mitigating circumstances, managing leave semesters and change of study program requests, and providing non-academic support, including wellbeing services;
4. Assuring and maintaining academic quality and standards;
5. Ensuring regulatory and statutory requirements are met;
6. Administering students’ finances, including the exchange of information and data with Chancen GmbH and Chancen eG;
7. Providing IT services, including email and other communication tools (for more information, please see section 12 below);
8. Processing queries, complaints, appeals, and disciplinary actions;
9. Publishing basic information to students, staff, and partners;
10. Ensuring the safety of all students and preventing crime;
11. Preparing and conducting internal and external compliance audits;
12. Ensuring regulatory and legal requirements, including regular reporting to German authorities, are met.
Further, CODE may exchange information with partner organizations as outlined in section 5.2 where the exchange is considered to be of the legitimate interests of CODE or the partner organization The exchange is on the basis that the student has opted in and restricted as outlined in GDPR Art. 6, Par. 1(f).
5. Who Has Access to Your Data and How Is It Shared?
Access to your data in our databases and systems is limited to employees of CODE and only for the purposes outlined in section 4.1. Further, access to various data sets and subsets is linked to employees’ roles and responsibilities.
CODE does not sell the data of students to third parties. CODE does also not share your data with third parties for marketing purposes.
5.1. Sharing Your Data with Other Students
We share limited personal information with other students via your profile in the communication tools used by us. This is initially limited to your name, study program, and CODE email address.
You can choose to make additional information available to students and employees of CODE in your profile. We may transfer additional personal data of yours across internal tools. This is limited to information that you yourself have chosen to make available in your profiles that are internally available for others to view.
Your rights outlined in section 11 below apply.
5.2. Sharing Your Data with Third Parties
5.2.1. Factory GmbH
For you to have access to the premises and be an active part of the CODE community, we need to ensure you have access to Factory.
To enter into a membership agreement with Factory Works GmbH on your behalf, we share the following personal information with Factory Works GmbH:
1. Your full name
2. Your date of birth
3. Your CODE email address
4. Date of exmatriculation upon graduation or leaving CODE without a degree
Factory GmbH’s privacy policy can be found here: https://factoryberlin.com/
5.2.2. CHANCEN GmbH and CHANCEN eG
Chancen GmbH handles all tuition fee payments for CODE and therefore we may need to share your personal information with CHANCEN GmbH or CHANCEN eG.
We share the following information with CHANCEN GmbH and/or CHANCEN eG:
1. Your full name;
2. Your permanent study address;
3. Your address stated on your ID (Street Nr., Postal Code, City, Country);
4. Your date and place of birth;
5. Your citizenship;
6. Your type of ID/passport;
7. Your phone and/or mobile number;
8. Gender;
9. Your CODE email address;
10. Your private email address;
11. Enrollment number;
12. Contract conditions such as payment choice and amount of tuition fees;
13. Details about your studies at CODE, including your study program and the start of studies;
14. Information about leave semesters, if any;
15. Information about change of study program, if any;
16. Details about your exmatriculation/graduation.
Chancen’s privacy policy can be found here: https://chancen-eg.de/en/impressum
5.2.3. Partner companies
CODE partners with non-profit, for-profit, and public sector institutions to enrich the learning experience at CODE with first-hand practical insights and meaningful project ideas. You might interact with representatives of these partners in two different contexts:
1. Employees of partner companies might act as lecturers, project sponsors, project mentors, or in a similar capacity under the explicit supervision and authorization of a CODE faculty member and under the condition that they agree to the standard privacy and non-disclosure agreements that CODE concludes with all internal and external lecturers. For them to be able to provide educational services to you, they might be integrated into our shared IT infrastructure (such as slack, Learning Platform, or similar) where they are treated (in terms of access rights, etc.) as if they were internal lecturers.
2. You can actively opt-in to participate in recruiting activities with our partners and other external companies or individuals. In that case, the information you share about yourself (for example a CV, portfolio, expected salary, availabilities for internships, student jobs, etc.) might be shared with externals for the purpose of them considering you for open positions in their company. Information is only shared under the condition that they treat your data at least as privately as if you had applied with them directly. You can opt out of this anytime and the rights as listed below (section 11) apply.
Representatives of partners are forbidden to treat personalized information given to them about you in one context for anything else than the explicit purpose listed in section 4.
5.2.4. Other Third Parties
We also share some of your personal information with third parties involved in your education, including visiting lecturers, partners, partner higher education institutions and external facilities used for teaching and learning or any other event related to your role as a member of the CODE community.
Some of your data will also be processed and shared in order for us to meet our statutory requirements, because it is in the public interest or because it is required for a third party’s interest.
In this context, your personal data may be processed and shared as follows:
1. To meet one of our statutory requirements by sharing your data, including data from the time before you joined CODE, with the Federal Statistical Office of Germany (Statistisches Bundesamt) and, if required, with other agencies as required by federal or state law or regulation;
2. To process students’ study abroad and any academic achievements from outside of CODE;
3. To monitor CODE’s performance as a higher education provider;
4. To improve and enhance the management of CODE;
5. To monitor and promote equality and diversity;
6. To seek legal advice;
7. To recover money owed to us.
The following personal information may be shared with third parties for the purposes listed above:
1. Your full name;
2. Your CODE email address;
3. Your study program;
4. Any additional information you published in your profile(s) on any of our communication tools
5. Your coursework (both written and practical), feedback forms, grade, module and course outcomes;
6. Anonymized equal opportunities monitoring data;
7. Anonymized feedback given by you to CODE.
Details about the information we are required to share with the Federal Statistical Office of Germany can be found on their website:
Additional information may be shared with third parties in cases where we need to establish, exercise, or defend legal claims.
Please also refer to section 12 for more information on third parties.
5.2.5. Sharing Your Data for the Purposes of a Student Visa
CODE offers students in need of a student visa to enter and study in Germany assistance with the visa application extension process.
To provide this service, we will need to process the data required application form for a visa or residence permit as issued by the Immigration Office. By completing this form and submitting it to CODE in order to receive support with your visa application, you agree for us to store and process the data provided in the application form.
Among other things, the following information is processed and shared with the Berlin Immigration Office:
1. Your passport photo;
2. Your full name;
3. Your date and place of birth;
4. Your citizenship;
5. A copy of your passport;
6. Your full address;
7. Duration of studies
8. Type of study degree
9. Study contract
10. Certificate of Enrollment
11. Proof of Health Insurance provider provided by the student
12. Proof of bank account provided by the student
13. Transcript of records, if applicable
14. Date of exmatriculation upon graduation or/and leaving CODE without a degree
For a comprehensive overview of data included in the application form, please check the application form itself which can be found on [the website of the Landesamt für Einwanderung]
Students can choose to apply for the visa themselves without CODE’s assistance. While we do not need the full details of your visa application, we will need you to share the outcome of your application with us.
6. Equal Opportunities Monitoring
CODE is committed to creating and maintaining a diverse, inclusive, positive, and supportive environment for its students.
In order to monitor this, we may collect equal opportunities monitoring information at the point of application or at any point during your studies.
Any such information will stay confidential and is kept separate from the application and only available to relevant employees. It is not taken into account when considering candidates for a place in a program of study at CODE.
Anonymous statistics are shared more widely across CODE and with third parties both in an effort to monitor equal opportunities, to ensure statutory requirements have been met, or because it is required for a third party’s legitimate interest.
7. Data We Hold, How We Collect It, and How We Store It
We are legally required to hold some types of information to fulfill our statutory obligations. Other types of information need to be held by us to perform our contract.
We will hold your personal information on our systems for as long as it is necessary for the relevant activity, or as long as it is set out in any relevant contract you hold with us. Other information is required in order for us to fulfill our contractual obligations. Some of your personal information may be held in perpetuity unless you exercise your rights outlined in section 11 below. Personal information normally held in perpetuity is listed in section 8 below.
7.1. Data Held About You
CODE holds data about you in order to perform its duties and for the performance of a contract.
This information is collected at the point of application, enrollment, or at any point during studies, using online forms.
We may collect the following types of data:
1. Your full name stated on ID/passport, date and place of birth stated on ID/passport, contact information (including private email address, mobile, and phone number, Skype user ID, home address, residence address, correspondence address, next of kin contact details and address, emergency contact details, nationality, country of birth, country of permanent residence, German immigration history and requirements, criminal convictions. We will also ask you to upload a passport photo.
2. You will be allocated a unique enrollment number and email address by CODE.
3. Higher Education Entrance Qualification certificates, including the issuing body and date.
4. Certificate of non-objection from previous studies, including the issuing body and date, if applicable.
5. Program of study applied for and start date and admissions decisions as well as information on how you intend to pay your fees, including bursary.
6. Coursework, assessment forms, grades, module results, and course outcomes.
7. Internships completed at CODE partner companies, if applicable.
8. Type and period of Scholarships or/and government loan.
9. Other information related to your studies, including, but not limited to change of study program and leave semester requests.
10. Any information provided as part of your application (in which you may choose to include personal information), details about proficiency in English, education history, including predicted and actual results, and qualifications awarded.
11. We also ask you to upload a CV as part of your application.
12. Bank account, debit, or credit card details.
13. Finally, we outlined in section 4, we may collect personal data to enable equal opportunities monitoring. This includes your gender, gender ID, sexual orientation, ethnicity, disability, religion, or similar beliefs.
Our dedicated privacy policy for applicants can be found here: https://code.berlin/en/admission/applicant-privacy-policy/
Finally, additional data may be collected and stored by providers of third-party applications used by CODE, including its only application system and student records system. This may include IP addresses of users, any location information contained there, and any actions taken by a user while signed in to their account, including a timestamp, which may be stored in an activity log.
7.2. Data Storage
Data about students is stored in various databases and systems used by CODE to conduct its business. Access to those databases is secure and restricted to CODE employees who require it to perform their duties.
Some of these databases and systems used are provided and hosted by a third-party provider who will publish their own privacy policies.
CODE is committed to reviewing the privacy and data protection policies of providers of third-party systems on a regular basis.
8. Data Retention
Your personal data is processed and retained for the performance of a contract as per this policy for the duration of your studies and, if applicable, up to the point of graduation. This includes any leave semesters.
At the point of graduation, we will retain the following data in perpetuity unless requested otherwise by the student:
1. Your name, including any previous name(s) (if applicable);
2. Name of program studied;
3. Module results;
4. Outcome/final award (if applicable);
5. Date of award (if applicable);
6. Any donations made (if applicable).
Any records pertaining to a student’s finances will be retained by CODE for up to six years following the end of the fiscal year to which they relate unless a longer timeframe applies as separate agreements with CODE and/or Chancen eG or Chancen GmbH.
Data of unsuccessful applicants is stored in line with the CODE Applicant Privacy Policy: https://code.berlin/en/admission/applicant-privacy-policy/
9. Updating Your Data
It is important to us that we always hold the most-up-date information about you and to ensure that you can exercise your ‘right to rectification’ under GDPR Article 16. To update your data held by CODE, please complete the online form available via the Wiki.
Once a request has been received, it is normally processed within one month.
10. Getting in Contact with You
Our communications are normally via our communication tool or email and most communications are only sent out electronically. In some instances, however, we may also contact you by phone (mobile or home). In some cases, we will also contact you by post.
Students are normally only contacted via their CODE account. In some exceptional circumstances, however, the need may arise to contact a student on their personal email accounts.
Students may restrict the usage of their personal email address as outlined in section 11.
CODE’s newsletter subscription works on an opt-in basis. If you have previously opted in, you may opt-out of receiving the CODE newsletter, emails about events or fundraising, etc. It is, however, necessary for CODE to communicate with you about matters pertaining to your studies, support, and welfare for the performance of a contract.
If you prefer not to receive our newsletter, emails about events, or fundraising, you can opt-out by emailing: dataprivacy@code.berlin
11. Your Rights
11.1. Right to Access
Under GDPR Article 15, you have the right to access the personal and supplementary information held about you by us.
To access this information, please email dataprivacy@code.berlin
Information will be provided at the latest within one month of receipt.
11.2. Right to Erasure
At the point where we no longer need to process your data for the performance of a contract, you have the right to ask us to stop processing your personal data. Please note that this does not apply if you are a current student or recently finished the program of study and await graduation. If you choose to exercise this right, we will delete most of your personal data held by us.
We will, however, retain some basic information, more specifically:
1. Your name, including any previous name(s) (if applicable);
2. Name of program studied;
3. Module results;
4. Outcome/final award (if applicable);
5. Date of award (if applicable).
Any data that remains on our database(s) can only be accessed by Student Affairs and the Examination Office for administrative or statistical (anonymous) purposes. Please refer to section 11 if you do not want your data to be used for statistical purposes.
Any records pertaining to a student’s finances will be retained for up to six years to ensure we meet our statutory obligations.
To exercise your right to erasure, we suggest that you send us an email at dataprivacy@code.berlin
You may also make your request verbally by contacting the Data Protection Officer who will confirm your request in writing and pass on your request to relevant members of staff.
Your request will be processed within one month and after having received and processed your request, we will no longer contact you by email, phone or post or any other means.
11.3. Right to Restrict Processing
You have the right to restrict the way in which your data is processed as long as the processing falls outside the performance of a contract.
To exercise your right to restrict processing, we suggest that you send us an email at dataprivacy@code.berlin
You may also make your request verbally by contacting the Data Protection Officer who will confirm your request in writing and pass on your request to relevant members of staff.
Your request will be processed within one month.
11.4. Right to Data Portability
You have the right to obtain your data held by CODE and reuse it for your own purposes across different environments.
CODE will ensure that any data transmitted to you is transmitted securely.
To exercise your right to obtain your data, we suggest that you send us an email at dataprivacy@code.berlin
You may also make your request verbally by contacting the Data Protection Officer who will confirm your request in writing and pass on your request to relevant members of staff.
Your request will be processed within one month.
11.5. Right to Object
You have the right to object to your data being used for purposes of scientific/historical research and statistics.
To exercise your right to restrict processing, please email dataprivacy@code.berlin
You should note, however, that this right may be limited by other statutory or regulatory requirements, such as our obligation to submit a regular report to the Federal Statistical Office of Germany.
11.6. Rights in Relation to Automated Decision Making and Profiling
CODE does not use automated decision-making or profiling in the context of its students.
We may, however, use your personal information to ensure study groups are diverse and reflect the diverse nature of CODE. This is not done in an automated way and with a view that it benefits the students’ experience.
11.7. Changes to our Privacy Policies
Our privacy policies are reviewed regularly, usually on an annual basis. Updates will be posted on our website.
If we ever make significant changes to the way we process your personal data, we will either clearly highlight this on our website or write to you directly.
12. Tools and IT Environments
CODE uses several tools and services to collect and process your data as outlined in section 4.
Tools and services used by are listed below together with links to the relevant privacy policy or data protection statement.
1. AWS (Servers located in the EU)
2. Back HQ (Servers located in the EU)
3. Calendly (Servers located in the USA) (transfer of data on the basis of the EU standard contract clauses)
4. Factory Platform (Servers located in the EU/IRELAND)
5. Google Workspace, including Google Mail and Google Drive (Servers located GLOBALLY including the USA) (transfer of data on the basis of the EU standard contract clauses)
6. Hubspot (Servers located in the EU/IRELAND)
7. Miro (Servers located in the USA) (transfer of data on the basis of the EU standard contract clauses)
8. Notion (Servers located in the USA) (transfer of data on the basis of the EU standard contract clauses)
9. Slack (Servers located in the EU/IRELAND) (transfer of data on the basis of the EU standard contract clauses)
10. SurveyMonkey (Servers located in the USA) (transfer of data on the basis of the EU standard contract clauses)
11. Zapier (Servers located GLOBALLY including the USA) (transfer of data on the basis of the EU standard contract clauses)
12. Zoom (Servers located GLOBALLY including the USA) (transfer of data on the basis of the EU standard contract clauses)