Privacy Policy

Privacy policy of sust.biz Academy

Introduction

This privacy policy explains the nature, scope and purpose of the collection and use of personal data on the website https://sust.biz/academy/ (hereinafter referred to as "website") by sust.biz GmbH & Co. KG (hereinafter referred to as "we" or "us"). We are the controller responsible for all personal data collected on the website, unless this privacy policy contains different information.

Personal data is information that can be used to identify a person, i.e. information that can be traced back to a person. This typically includes your name, email address or telephone number. However, purely technical data that can be assigned to a person is also considered personal data.

Overview of data processing on the website

Personal data is processed on this website as part of the following procedures:

1. Booking of Academy services
2. Server log files
3. Tracking and advertising tools
4. Contact
5. Provision of services

The actual provision of services does not take place on this website, but on the website of our partner, GoHighLevel. The currently valid privacy policy of GoHighLevel can be found here.

1. Booking services

You can purchase e-learning courses on this website and will be asked to enter the following personal data for this purpose:

• Title, first name, surname,
• Company (optional),
• Address,
• Email address,
• Payment details.

This data will be processed exclusively for the purpose of granting access and processing payment.

Legal basis
The processing of personal data within the scope of the procedure described above is based on Art. 6 para. 1 lit. b GDPR. This legal basis permits the processing of personal data to the extent necessary for the conclusion and fulfilment of a contract. The above-mentioned data is required for the conclusion of the contract for the purchase of our content.

Duration of data storage
The data mentioned in this procedure will be stored for 10 years in accordance with commercial and tax law retention obligations pursuant to Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB).

2. Server log files

We automatically collect a range of technical data, which is personal data, each time you access the website. This includes:

• IP address of the user
• Name of the website or file accessed
• Date and time of access
• Amount of data transferred
• Notification of successful retrieval
• Browser type and version
• User's operating system
• Device used by the user, including MAC address
• Referrer URL (the previously visited page)

This data is not merged with other personal data that you actively provide on the website. We collect server log files for the purpose of administering the website and detecting and preventing unauthorised access.

Legal basis
The personal data in log files is processed on the basis of Art. 6 para. 1 lit. f GDPR. This legal basis permits the processing of personal data within the scope of the "legitimate interest" of the controller, unless your fundamental rights, freedoms or interests prevail. Our legitimate interest lies in easier administration and the ability to detect and track hacking. You can object to this data processing at any time if there are reasons relating to your particular situation that speak against data processing. To do so, simply send an email to hello@sust.biz.

What are IP addresses?
IP addresses are assigned to every device (e.g. smartphone, tablet, PC) that is connected to the Internet. Which IP address this is depends on the Internet access via which your end device is currently connected to the Internet. This may be the IP address assigned to you by your Internet service provider, for example if you are connected to the Internet via your home Wi-Fi network. However, it may also be an IP address assigned to you by your mobile phone provider or the IP address of a public or private Wi-Fi provider or other Internet access provider. In its most common form (IPv4), the IP address consists of four blocks of digits. As a private user, you will usually not use a permanent IP address, as this is only assigned to you temporarily by your provider (known as a "dynamic IP address"). With a permanently assigned IP address (known as a "static IP address"), it is in principle easier to uniquely identify user data. Except for the purpose of tracking unauthorised access to our website, we do not use this data in a personalised manner, but only evaluate on an anonymous basis which of our web pages are preferred, how many visits are made each day and similar information.

Our website already supports the new IPv6 addresses. If you already have an IPv6 address, you should also know the following: The IPv6 address consists of eight blocks of four digits. As with the entire IPv4 address, the first four blocks are typically assigned dynamically to private users. However, the last four blocks of an IPv6 address (known as the "interface identifier") are determined by the device you use to browse the website. Unless otherwise specified in your operating system, the MAC address is used for this purpose. The MAC address is a type of serial number that is assigned to every IP-enabled device worldwide. We therefore do not store the last four blocks of your IPv6 address. In general, we recommend that you activate the so-called "privacy extensions" on your end device in order to better anonymise the last four blocks of your IPv6 address. Most common operating systems have a "privacy extensions" function, but in some cases this is not set by default.

Duration of data storage
The server log files containing the above data are automatically deleted after 30 days. We reserve the right to store the server log files for longer if there are facts that suggest unauthorised access (such as an attempted hack or a so-called DDOS attack).

3. Tracking and advertising tools

We analyse how our website is used statistically and use online marketing tools to increase the reach of our site. For these purposes, we use a variety of partners who provide various technologies and advertising networks. You can decide at any time via the Privacy Centre whether and, if so, which partners should be used . There you will also find information about which data the respective partners process and for what purpose. The storage period for cookies is also specified.

The partners do not receive any "real names" or other unique identifiers such as an address or date of birth. Instead, the partners only receive pseudonymous information such as a cookie ID or an IP address. Nevertheless, this data is also regularly personal data.

Declaration of consent

If you have given your comprehensive consent in the Cookie Management Policy when you first visited the website or at a later date, all of the partners listed under the above link may be active on our website.

If, instead of giving your global consent, you have only permitted individual partners to process your personal data, only these partners will process your data on our behalf.

You can revoke your declaration of consent at any time with future effect or opt out of each individual vendor. To do so, please also click on the link to the Privacy Centre above.

There are also the following alternative options for opting out:

• Open the privacy policy of the respective partner (you will find the link in the Privacy Centre). The partner's privacy policy will indicate an opt-out option.

• Activate the "Do not track" function in your browser (please note: if you disable cookies in your browser, you will prevent the activity of many but not all partners; this is because some partners use similar technologies for identification in addition to cookies).

• Set your preferences on the "youronlinechoices" website.

IAB TCF 2.0 ("Transparency and Consent Framework")

We only allow cookies that comply with the rules of IAB TCFv2.0.

The Transparency and Consent Framework ("TCF") is a set of rules for online marketing developed by the Interactive Advertising Bureau Europe ("IAB Europe"), an industry association for online marketing. (see general information about IAB Europe here: https://iabeurope.eu/about-us/ ). Version 2.0 of the TCF is currently in use (see general information about TCF2.0 here: https://iabeurope.eu/tcf-2-0/).

TCF 2.0 defines strict rules which, according to IAB Europe, ensure compliance with the GDPR and all other European data protection regulations ( ). We therefore only work with partners who have committed themselves to complying with the rules of the IAB TCF2.0 and who have been included in the so-called "Global Vendor List" after an audit (see https://iabeurope.eu/vendor-list/).

4. Contact

When you contact us (for example, by email or using the contact form), the information you provide will be stored for the purpose of processing your enquiry and in the event that follow-up questions arise.

Legal
The information provided when contacting us is processed on the basis of Art. 6 para. 1 lit. a and lit. f GDPR. This legal basis permits the processing of personal data within the scope of the "legitimate interest" of the controller, unless your fundamental rights, freedoms or interests prevail. Our legitimate interest lies in processing your contact request. You can object to this data processing at any time if there are reasons relating to your particular situation that prevent data processing. To do so, simply send an email to hello@sust.biz.

Duration of data storage
The personal data stored in connection with the contact will be deleted when the matter for which the contact was made has been fully clarified and it is not expected that the specific contact will be relevant again in the future.

5. Performance of services

As described, the actual provision of services is carried out by our partner GoHighLevel. During the performance of the services, GoHighLevel processes the following data:

Time stamp via
• the first registration
• the first course attendance (per course)
• access to content (per content item)
• completion of a course
Submitted answers to quizzes and surveys
Comments on contentThis data is processed exclusively for the purpose of providing the services.

Recipients of data
GoHighLevel, Street, Postcode, City ("GHL") provides you with the technical infrastructure for accessing the e-learning courses. In this context, GHL also processes the personal data referred to in section 2. We have entered into a data processing agreement with GHL at , which ensures that GHL will process your data exclusively on our behalf and in accordance with our instructions.

GHL has commissioned the cloud provider Amazon Web Services ("AWS") and the database provider MongoDB (both headquartered in the USA) to host the technical solution and the data. GHL has stated that all your data will be processed in the AWS "Availability Zone" in Frankfurt am Main and stored only in Germany.

Legal basis
The processing of personal data within the scope of the procedure described above is based on Art. 6 para. 1 lit. b GDPR. This legal basis permits the processing of personal data for the conclusion and performance of a contract. The above-mentioned data is required for the conclusion of the contract for the provision of a service.

Duration of data storage
The data specified in this procedure will be stored for 10 years in accordance with commercial and tax law retention obligations pursuant to Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB).

Contact details of the controller:
sust.biz GmbH & Co. KG
c/o combinat56

Adams-Lehmann-Straße 56
80797 Munich
+49 89 461331-686
Email: hello@sust.biz

You can reach our data protection officer at the following contact details:
Michael D‘heur
sust.biz GmbH & Co. KG
c/o combinat56

Adams-Lehmann-Straße 56
80797 Munich
+49 89 461331-686
Email: hello@sust.biz

Your rights
You have the right to obtain information about the personal data stored about you free of charge upon request. In addition, you have the right to request the correction of inaccurate data, the right to request the restriction of the processing of data that has been processed extensively, and the right to request the deletion of personal data that has been processed unlawfully or stored for too long (unless there is a legal obligation to retain such data or other reasons under Art. 17 (3) GDPR). Furthermore, you have the right to transfer all data you have provided to us in a commonly used file format (right to data portability), provided that you have provided the data to us within the scope of a declaration of consent or for the fulfilment of a contract. If you also have a right to object to the processing of individual procedures, we will point this out in the description of the individual procedures. To exercise your rights, simply send an email to hello@sust.biz.

In addition, you also have the right to lodge a complaint with a data protection supervisory authority. A list of German and European data protection officers and their contact details can be found here.

Voluntary provision of data
The provision of your personal data on this website is generally neither required by law nor contractually required. You are not obliged to provide personal data on this website. Nevertheless, the provision of the functions of this website requires the processing of your personal data.

Recipients of data
We do not pass on personal data unless we expressly mention this in this privacy policy. However, the website is hosted by our service provider Siteground. SiteGround Spain S.L., a company registered and existing under the laws of the Kingdom of Spain (registration number CIF: B87194171), with business address: Calle de Prim 19, 28004 Madrid, Spain, will also automatically process the above-mentioned personal data in this context. This is done exclusively on our instructions and on our behalf in accordance with a processing agreement pursuant to Art. 28 GDPR.

The transfer of personal data to the above-mentioned service provider is based on Art. 6 para. 1 lit. f GDPR. This legal basis permits the processing of personal data in our "legitimate interest" unless your fundamental rights, fundamental freedoms or interests in refraining from data processing prevail. Our legitimate interest lies in the use of specialised service providers who can provide appropriate hosting more efficiently than we can. You can nevertheless object to this data processing at any time if there are reasons relating to your particular situation that prevent the transfer of personal data to a server service provider. To do so, simply send an email to hello@sust.biz.