ReLead Learning Platform

Privacy Statement – ReLEAD Online Learning Platform

Responsible body (data controller)

The responsible body within the meaning of data protection legislation is: THE CIVICS Innovation Hub (THE CIVICS) as the organiser of the European Responsible Leadership Network programme (ReLEAD).

Email: relead@thecivics.eu

THE CIVICS processes personal data in accordance with applicable data protection laws, in particular the General Data Protection Regulation (GDPR).

Data protection officer

THE CIVICS has appointed a data protection officer:

Anja Ostermann
Bonner Talweg 64
53113 Bonn
Germany
Email: dataprotection@thecivics.eu

Legal basis for data processing

Personal data is processed on the following legal bases under Article 6 GDPR:

• Art. 6(1)(b) GDPR (performance of a contract): processing necessary for participation in the ReLEAD programme and provision of access to the learning platform
• Art. 6(1)(a) GDPR (consent): processing of optional data (e.g. profile information) and optional communications or evaluations
• Art. 6(1)(f) GDPR (legitimate interests): processing necessary to ensure the secure and efficient operation of the platform, prevent misuse, and improve the quality of the programme

Where processing is based on legitimate interests, these consist of ensuring platform security, maintaining system integrity, preventing unauthorised use, and continuously improving the programme and user experience.

Nature, scope and purpose of data collection and processing

THE CIVICS collects, processes, stores, and uses personal data only to the extent necessary for the organisation, implementation, and administration of the ReLEAD programme. This includes:

• Account and registration data (e.g. name, email address)
• Profile data (e.g. place of residence, age, gender if provided)
• Learning data within the platform (e.g. course enrolment, participation records, quiz results, completion status, and activity logs)
• Technical usage data (e.g. login timestamps, IP address for security purposes)

The purposes of processing include:

• managing participation in the programme
• providing access to and functionality of the Moodle learning platform
• tracking learning progress and supporting participants
• issuing certificates and carrying out programme-related reporting
• ensuring platform security and preventing misuse
• improving the quality and content of the programme

Provision of data

The provision of personal data is necessary for participation in the ReLEAD programme and access to the learning platform. Without providing the required data, participation in the programme is not possible.

Hosting and technical operation

The learning platform is based on Moodle and is hosted by an external hosting provider acting as a data processor within the meaning of Article 28 GDPR.

THE CIVICS ensures that:

• a Data Processing Agreement (DPA) is in place with the hosting provider
• personal data is processed only on documented instructions
• access to data is restricted to authorised personnel
• appropriate technical and organisational measures are implemented
  
  

Disclosure of data to third parties

Personal data will only be disclosed where necessary for programme delivery or where required by law. This may include:

• technical service providers (e.g. hosting, IT support), acting as data processors under Article 28 GDPR
• programme partners or co-organisers, where necessary for implementation of the ReLEAD programme and subject to appropriate contractual safeguards

All processors are contractually obliged to:

• process data only on instructions of THE CIVICS
• not use data for their own purposes
• implement appropriate security measures

Personal data will not be used for marketing purposes without explicit consent.

International data transfers

Personal data is generally processed within the EU/EEA. If data is ever transferred outside the EU/EEA, it will only be done under appropriate safeguards, such as EU Standard Contractual Clauses or a European Commission adequacy decision.

Data storage and retention

Personal data is stored only for as long as necessary for the purposes described above.

• Account and learning data are retained for the duration of the programme
• After programme completion, personal data will be deleted or anonymised within 6 months (or up to 12 months where necessary for certification, reporting, or administrative follow-up), unless legal retention obligations require longer storage
• Where data is processed based on consent, it will be deleted upon withdrawal of consent, unless continued storage is required for legal reasons
  
  

Cookies and platform data

The Moodle platform uses technically necessary cookies to ensure functionality (e.g. login sessions). If additional cookies or tracking technologies are used (e.g. analytics), users will be informed separately and, where required, asked to provide consent prior to activation.

External content and third-party services

The learning platform may include:

1. Embedded content or links to external websites (e.g. videos hosted on YouTube, reading materials on external sites, or interactive collaborative tools and whiteboards).
   • When accessing such content, personal data (e.g. IP address, usage data) may be processed by these external providers under their own privacy policies.
   • THE CIVICS does not control this processing and is not responsible for how these third parties handle data.
   • Users are advised to review the privacy policies of these external sites before use.
2. Online workshops via Zoom
   • Group workshops will be conducted using Zoom Workspace Pro as part of the ReLEAD programme.
   • Zoom acts as a data processor on behalf of THE CIVICS. Personal data processed may include participant names, email addresses, audio/video content, and chat messages.
   • A Data Processing Agreement (DPA) is in place with Zoom to ensure GDPR compliance.
   • By participating in Zoom workshops, participants agree that their data will be processed under the DPA and Zoom's privacy policy.
   • THE CIVICS has no control over Zoom's independent processing outside the scope of the DPA.
     
     

Rights of the data subject

You have the following rights under GDPR:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure ("right to be forgotten") (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)

Where processing is based on consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Requests can be submitted to: dataprotection@thecivics.eu

Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data violates GDPR.

Data security

THE CIVICS implements appropriate technical and organisational measures to a level of security appropriate to the risk, including protection against:

• unauthorised access
• loss
• misuse
• unauthorised alteration or disclosure
  
  

Changes to this privacy statement

This privacy statement may be updated from time to time to reflect legal, technical, or organisational changes. The latest version will always be available on the Moodle platform.